pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Scott Ribe <scott_ribe@elevated-dev.com>
To: David Ondrejik <david.ondrejik@noaa.gov>
Cc: Khangelani Gama <kgama@argility.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL
Date: Wed, 14 Mar 2012 09:46:42 -0600
Message-ID: <EDD98FDF-AAC8-48A7-A6AE-C1EE365D2C0E@elevated-dev.com> (raw)
In-Reply-To: <CAPVc05NLf_615WRcm9UT5iWWuVb0TkN3t_hkWkht-qrHzGPQyw@mail.gmail.com>
References: <8ecc4155e8754edef35e260a60a4a8db@mail.gmail.com>
	<1331722455.5503.166.camel@elliot>
	<bb7ee57f0e57557867afaf2033816241@mail.gmail.com>
	<1331730203.5503.174.camel@elliot>
	<CAPVc05NYyTM+fzo+phRBU0W26qdc+Ora5GJ6yui47q5sxocYLw@mail.gmail.com>
	<2CA18772-AF64-4147-8825-3E8DB98458AD@elevated-dev.com>
	<CAPVc05NLf_615WRcm9UT5iWWuVb0TkN3t_hkWkht-qrHzGPQyw@mail.gmail.com>

On Mar 14, 2012, at 9:28 AM, David Ondrejik wrote:

> So there is some trail to track back to the original user.

Yes, but once he has root shell, the trail ends there, and impersonation of anyone is once again trivial. Also, sudo su root, does work on some unices, and the option you don't want to advertise is, in my opinion, trivially obvious--but I'll respect the idea and not advertise it.

-- 
Scott Ribe
scott_ribe@elevated-dev.com
http://www.elevated-dev.com/
(303) 722-0567 voice







view thread (17+ messages)  latest in thread

Message-ID: <EDD98FDF-AAC8-48A7-A6AE-C1EE365D2C0E@elevated-dev.com>
Permalink:  ../EDD98FDF-AAC8-48A7-A6AE-C1EE365D2C0E@elevated-dev.com/
Also on:    postgresql.org/message-id/EDD98FDF-AAC8-48A7-A6AE-C1EE365D2C0E@elevated-dev.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: scott_ribe@elevated-dev.com, david.ondrejik@noaa.gov, kgama@argility.com
  Subject: Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL
  In-Reply-To: <EDD98FDF-AAC8-48A7-A6AE-C1EE365D2C0E@elevated-dev.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox