Received: from magus.postgresql.org (magus.postgresql.org [87.238.57.229]) by mail.postgresql.org (Postfix) with ESMTP id E1EB51B505F1 for ; Wed, 14 Mar 2012 12:47:07 -0300 (ADT) Received: from asbnvacz-mailrelay01.megapath.net ([207.145.128.243]) by magus.postgresql.org with esmtp (Exim 4.72) (envelope-from ) id 1S7qPk-0003o8-Ax for pgsql-admin@postgresql.org; Wed, 14 Mar 2012 15:47:06 +0000 Received: from mail7.sea5.speakeasy.net (mail7.sea5.speakeasy.net [69.17.117.52]) by asbnvacz-mailrelay01.megapath.net (Postfix) with ESMTP id BAE1CA71611 for ; Wed, 14 Mar 2012 11:46:45 -0400 (EDT) Received: (qmail 21687 invoked from network); 14 Mar 2012 15:46:45 -0000 Received: by simscan 1.4.0 ppid: 18271, pid: 6773, t: 1.1953s scanners: clamav: 0.88.2/m:52/d:13513 spam: 3.0.4 Received: from 205-168-220-157.dia.static.qwest.net (HELO [192.168.2.118]) (sribe@elevated-dev.com@[205.168.220.157]) (envelope-sender ) by mail7.sea5.speakeasy.net (qmail-ldap-1.03) with AES128-SHA encrypted SMTP for ; 14 Mar 2012 15:46:43 -0000 Subject: Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Scott Ribe In-Reply-To: Date: Wed, 14 Mar 2012 09:46:42 -0600 Cc: Khangelani Gama , pgsql-admin@postgresql.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <8ecc4155e8754edef35e260a60a4a8db@mail.gmail.com> <1331722455.5503.166.camel@elliot> <1331730203.5503.174.camel@elliot> <2CA18772-AF64-4147-8825-3E8DB98458AD@elevated-dev.com> To: David Ondrejik X-Mailer: Apple Mail (2.1084) X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on mail7.sea5 X-Spam-Level: X-Spam-Status: No, score=0.0 required=8.0 tests=none autolearn=disabled version=3.0.4 X-Pg-Spam-Score: -1.9 (-) X-Archive-Number: 201203/86 X-Sequence-Number: 39274 On Mar 14, 2012, at 9:28 AM, David Ondrejik wrote: > So there is some trail to track back to the original user. Yes, but once he has root shell, the trail ends there, and impersonation = of anyone is once again trivial. Also, sudo su root, does work on some = unices, and the option you don't want to advertise is, in my opinion, = trivially obvious--but I'll respect the idea and not advertise it. --=20 Scott Ribe scott_ribe@elevated-dev.com http://www.elevated-dev.com/ (303) 722-0567 voice