pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedIs it okay to run Postgres service account as a domain account (on Linux)?
7+ messages / 5 participants
[nested] [flat]
* Is it okay to run Postgres service account as a domain account (on Linux)?
@ 2018-02-26 16:22 David <dbwagoner@gmail.com>
0 siblings, 3 replies; 7+ messages in thread
From: David @ 2018-02-26 16:22 UTC (permalink / raw)
To: pgsql-admin
Just wondering if it is recommended, or not, to run Postgres as a domain
account on Linux. If not, then why not?
Thank you,
David
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Is it okay to run Postgres service account as a domain account (on Linux)?
@ 2018-02-26 19:50 Alvaro Aguayo Garcia-Rada <aaguayo@opensysperu.com>
parent: David <dbwagoner@gmail.com>
2 siblings, 1 reply; 7+ messages in thread
From: Alvaro Aguayo Garcia-Rada @ 2018-02-26 19:50 UTC (permalink / raw)
To: David <dbwagoner@gmail.com>; +Cc: pgsql-admin
Even when possible, I won't recommend it; not for postgres reasons, but for security. If someone compromises the domain account, could gain access to postgres data with no restriction. Unless there is a reason to use a domain account, of source.
Saludos,
Alvaro Aguayo
Jefe de Operaciones
Open Comb Systems E.I.R.L.
Oficina: (+51-1) 3377813 | Cel.: (+51) 995540103 | RPC: (+51) 954183248
Website: www.ocs.pe
----- Original Message -----
From: "David" <dbwagoner@gmail.com>
To: "pgsql-admin" <pgsql-admin@postgresql.org>
Sent: Monday, 26 February, 2018 11:22:34
Subject: Is it okay to run Postgres service account as a domain account (on Linux)?
Just wondering if it is recommended, or not, to run Postgres as a domain
account on Linux. If not, then why not?
Thank you,
David
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Is it okay to run Postgres service account as a domain account (on Linux)?
@ 2018-02-26 20:09 Azimuddin Mohammed <azimeiu@gmail.com>
parent: Alvaro Aguayo Garcia-Rada <aaguayo@opensysperu.com>
0 siblings, 0 replies; 7+ messages in thread
From: Azimuddin Mohammed @ 2018-02-26 20:09 UTC (permalink / raw)
To: Alvaro Aguayo Garcia-Rada <aaguayo@opensysperu.com>; +Cc: David <dbwagoner@gmail.com>; pgsql-admin
If you want to run postgres with a different account I say why not. While
initializing the db you need to mention what user u want to run as super
user.
On Feb 26, 2018 1:50 PM, "Alvaro Aguayo Garcia-Rada" <
aaguayo@opensysperu.com> wrote:
> Even when possible, I won't recommend it; not for postgres reasons, but
> for security. If someone compromises the domain account, could gain access
> to postgres data with no restriction. Unless there is a reason to use a
> domain account, of source.
>
> Saludos,
>
> Alvaro Aguayo
> Jefe de Operaciones
> Open Comb Systems E.I.R.L.
>
> Oficina: (+51-1) 3377813 | Cel.: (+51) 995540103 | RPC: (+51) 954183248
> Website: www.ocs.pe
>
> ----- Original Message -----
> From: "David" <dbwagoner@gmail.com>
> To: "pgsql-admin" <pgsql-admin@postgresql.org>
> Sent: Monday, 26 February, 2018 11:22:34
> Subject: Is it okay to run Postgres service account as a domain account
> (on Linux)?
>
> Just wondering if it is recommended, or not, to run Postgres as a domain
> account on Linux. If not, then why not?
>
> Thank you,
>
> David
>
>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Is it okay to run Postgres service account as a domain account (on Linux)?
@ 2018-02-26 20:12 David <dbwagoner@gmail.com>
0 siblings, 1 reply; 7+ messages in thread
From: David @ 2018-02-26 20:12 UTC (permalink / raw)
To: pgsql-admin
For the purposes of my question, Postgres would run as domain\postgres,
rather than a local Linux user account.
Thanks.
On Mon, Feb 26, 2018 at 3:09 PM, Azimuddin Mohammed <azimeiu@gmail.com>
wrote:
> If you want to run postgres with a different account I say why not. While
> initializing the db you need to mention what user u want to run as super
> user.
>
> On Feb 26, 2018 1:50 PM, "Alvaro Aguayo Garcia-Rada" <
> aaguayo@opensysperu.com> wrote:
>
>> Even when possible, I won't recommend it; not for postgres reasons, but
>> for security. If someone compromises the domain account, could gain access
>> to postgres data with no restriction. Unless there is a reason to use a
>> domain account, of source.
>>
>> Saludos,
>>
>> Alvaro Aguayo
>> Jefe de Operaciones
>> Open Comb Systems E.I.R.L.
>>
>> Oficina: (+51-1) 3377813 | Cel.: (+51) 995540103 | RPC: (+51) 954183248
>> Website: www.ocs.pe
>>
>> ----- Original Message -----
>> From: "David" <dbwagoner@gmail.com>
>> To: "pgsql-admin" <pgsql-admin@postgresql.org>
>> Sent: Monday, 26 February, 2018 11:22:34
>> Subject: Is it okay to run Postgres service account as a domain account
>> (on Linux)?
>>
>> Just wondering if it is recommended, or not, to run Postgres as a domain
>> account on Linux. If not, then why not?
>>
>> Thank you,
>>
>> David
>>
>>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Is it okay to run Postgres service account as a domain account (on Linux)?
@ 2018-02-26 20:58 Bear Giles <bgiles@coyotesong.com>
parent: David <dbwagoner@gmail.com>
0 siblings, 0 replies; 7+ messages in thread
From: Bear Giles @ 2018-02-26 20:58 UTC (permalink / raw)
To: David <dbwagoner@gmail.com>; +Cc: pgsql-admin
What problem is this solving?
On Mon, Feb 26, 2018 at 1:12 PM, David <dbwagoner@gmail.com> wrote:
> For the purposes of my question, Postgres would run as domain\postgres,
> rather than a local Linux user account.
>
> Thanks.
>
>
>
> On Mon, Feb 26, 2018 at 3:09 PM, Azimuddin Mohammed <azimeiu@gmail.com>
> wrote:
>
>> If you want to run postgres with a different account I say why not. While
>> initializing the db you need to mention what user u want to run as super
>> user.
>>
>> On Feb 26, 2018 1:50 PM, "Alvaro Aguayo Garcia-Rada" <
>> aaguayo@opensysperu.com> wrote:
>>
>>> Even when possible, I won't recommend it; not for postgres reasons, but
>>> for security. If someone compromises the domain account, could gain access
>>> to postgres data with no restriction. Unless there is a reason to use a
>>> domain account, of source.
>>>
>>> Saludos,
>>>
>>> Alvaro Aguayo
>>> Jefe de Operaciones
>>> Open Comb Systems E.I.R.L.
>>>
>>> Oficina: (+51-1) 3377813 | Cel.: (+51) 995540103 | RPC: (+51) 954183248
>>> Website: www.ocs.pe
>>>
>>> ----- Original Message -----
>>> From: "David" <dbwagoner@gmail.com>
>>> To: "pgsql-admin" <pgsql-admin@postgresql.org>
>>> Sent: Monday, 26 February, 2018 11:22:34
>>> Subject: Is it okay to run Postgres service account as a domain account
>>> (on Linux)?
>>>
>>> Just wondering if it is recommended, or not, to run Postgres as a domain
>>> account on Linux. If not, then why not?
>>>
>>> Thank you,
>>>
>>> David
>>>
>>>
>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Is it okay to run Postgres service account as a domain account (on Linux)?
@ 2018-02-26 21:01 Bear Giles <bgiles@coyotesong.com>
parent: David <dbwagoner@gmail.com>
2 siblings, 0 replies; 7+ messages in thread
From: Bear Giles @ 2018-02-26 21:01 UTC (permalink / raw)
To: David <dbwagoner@gmail.com>; +Cc: pgsql-admin
On Mon, Feb 26, 2018 at 9:22 AM, David <dbwagoner@gmail.com> wrote:
> Just wondering if it is recommended, or not, to run Postgres as a domain
> account on Linux. If not, then why not?
>
> Thank you,
>
> David
>
What problem is this solving?
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Is it okay to run Postgres service account as a domain account (on Linux)?
@ 2018-02-26 21:29 Tim Cross <theophilusx@gmail.com>
parent: David <dbwagoner@gmail.com>
2 siblings, 0 replies; 7+ messages in thread
From: Tim Cross @ 2018-02-26 21:29 UTC (permalink / raw)
To: David <dbwagoner@gmail.com>; +Cc: pgsql-admin
If your running postgres on Linux, you have to have a Linux account on the
server to run postgres[1]. It would be possible to have the linux server
configured to use AD/Kerberos for authentication and that might be
justified in some environments e.g. where you have a Windows based identity
and access management system, but you will still need an account on the
Linux system. The downside of doing this is that your just adding another
possible failure point.
You are probably better off just going with 'standard' practices and have
the normal postgres user, but restrict access to the server. You can then
have a separate administrator account which uses AD/Kerberos and do all
your administration using that account (or a number of accounts with
minimum access levels needed depending on your requirements, such as one
per database).
1. There are 'clever' things you can do to enable those with AD accounts to
login to a Linux system which does not require running 'adduser' on the
Linux host, but these solutions tend not to work well when you want to run
'services' on that host using one of those accounts. For example, you have
to add 'clevel' boot facilities to ensure the AD/Kerberos infrastructure is
running before the postgres server and if it isn't, deal with things
gracefully etc. Things quickly become very complicated.
On 27 February 2018 at 03:22, David <dbwagoner@gmail.com> wrote:
> Just wondering if it is recommended, or not, to run Postgres as a domain
> account on Linux. If not, then why not?
>
> Thank you,
>
> David
>
--
regards,
Tim
--
Tim Cross
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2018-02-26 21:29 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2018-02-26 16:22 Is it okay to run Postgres service account as a domain account (on Linux)? David <dbwagoner@gmail.com>
2018-02-26 19:50 ` Alvaro Aguayo Garcia-Rada <aaguayo@opensysperu.com>
2018-02-26 20:09 ` Azimuddin Mohammed <azimeiu@gmail.com>
2018-02-26 21:01 ` Bear Giles <bgiles@coyotesong.com>
2018-02-26 21:29 ` Tim Cross <theophilusx@gmail.com>
2018-02-26 20:12 Re: Is it okay to run Postgres service account as a domain account (on Linux)? David <dbwagoner@gmail.com>
2018-02-26 20:58 ` Bear Giles <bgiles@coyotesong.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox