DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:mime-version:content-type;
	b=rnzO9BlXF5YW8Jx0gCl1aau/M9c/D8mIYFkk7jigdQk8WzUz5jSXJfbCurTEjQBqba
	yqBf9pODYAdSW54EBcYnsAe2EgYkhpYudz+8ceGA/NkrIm/8gmreEhcCa6L/4Fuj1jZc
	sKCPuS4GhlzJQq0swK2fgOeG0DL896ROnVX1w=
Message-ID: <b594cade0807110239m2fd09f6an229b07f22c75ecb1@mail.gmail.com>
Date: Fri, 11 Jul 2008 10:39:43 +0100
From: "niall el-assaad" <niallel@gmail.com>
To: pgsql-admin@postgresql.org
Subject: Password recommendations for an appliance
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_16553_26927976.1215769183204"

------=_Part_16553_26927976.1215769183204
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,
I'm developing an appliance that runs postgresql and will be provided to
many people.

I am wondering on the best way of protecting the database user account.

At the moment the account has no password on it, to me this means that the
only people who can connect are the application (PHP running on the box), or
someone logged in as root at the linux command line of the appliance (which
means they have permission to anything anyway).

In this scenario is it worth putting a password on the user account? The
password would need to be stored in a file on the box anyway (so the root
user could get to it quite easily)?

I'm wondering if there are any best practices for this, as I've seen many
appliances that don't bother with a password, and only a few that do use a
password.

Opinions very welcome.

thanks,

niall

------=_Part_16553_26927976.1215769183204
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,<div><br></div><div>I&#39;m developing an appliance that runs postgresql and will be provided to many people.</div><div><br></div><div>I am wondering on the best way of protecting the database user account.</div><div><br>
</div><div>At the moment the account has no password on it, to me this means that the only people who can connect are the application (PHP running on the box), or someone logged in as root at the linux command line of the appliance (which means they have permission to anything anyway).</div>
<div><br></div><div>In this scenario is it worth putting a password on the user account? The password would need to be stored in a file on the box anyway (so the root user could get to it quite easily)?</div><div><br></div>
<div>I&#39;m wondering if there are any best&nbsp;practices&nbsp;for this, as I&#39;ve seen many appliances that don&#39;t bother with a password, and only a few that do use a password.</div><div><br></div><div>Opinions very welcome.</div>
<div><br></div><div>thanks,</div><div><br></div><div>niall</div>

------=_Part_16553_26927976.1215769183204--