From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Frank Eckes <frank.eckes@online.de>
To: pgsql-admin@lists.postgresql.org
Subject: Re: security issues
Date: Fri, 10 Dec 2021 17:20:19 +0100
Message-ID: <ba32f586b2ba90c1909f32f6cdabefc3a0fc325d.camel@cybertec.at> (raw)
In-Reply-To: <5235c46a-508e-f084-c8bc-738a6e99fd44@online.de>
References: <5235c46a-508e-f084-c8bc-738a6e99fd44@online.de>
On Fri, 2021-12-10 at 15:33 +0100, Frank Eckes wrote:
> To access data in a PostgreSQL database I write queries which contains
> the business rules
>
> how t access data. This is working fine and also the permission are
> working fine.
>
> But I found out that a user can see the complete business rules in a
> query or a procedure which is
>
> a big security issue.
>
> Is there e possibility that I can hide the definition and th user can
> only see the data or can execute
>
> the procedure/function.
No, there is no good way to do that.
It is very unusual to put secret information into a view definition...
> And even worse, if i define a foreign server (e.g ORACLE) everybody can
> see the credentials in a user mapping
>
> which should not be allowed. This might be a show stopper of using
> PostgreSQL in security environments.
Then you use Oracle external authentication, for example with a
secure key store on the PostgreSQL server. Then you don't need a
password.
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, frank.eckes@online.de, pgsql-admin@lists.postgresql.org
Subject: Re: security issues
In-Reply-To: <ba32f586b2ba90c1909f32f6cdabefc3a0fc325d.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox