From: Domingo Alvarez Duarte <mingodad@gmail.com>
To: lennin.caro@yahoo.com
Cc: Carol Walter <walterc@indiana.edu>
Cc: pgsql-admin@postgresql.org
Subject: Re: Extended security/restriction to any role with login access
Date: Fri, 27 Jun 2008 16:35:46 +0200
Message-ID: <c2f38c3e0806270735l7a18d39et3e61a2c0a5ea4ecf@mail.gmail.com> (raw)
In-Reply-To: <607359.23897.qm@web59503.mail.ac4.yahoo.com>
References: <c2f38c3e0806261445q5f36a2d7j2172b7f19a75b42b@mail.gmail.com>
<607359.23897.qm@web59503.mail.ac4.yahoo.com>
Look this isn't the point I know what can be done with pg_hba.conf
The main point is:
When I create a postgresql user and grant to it only access to part of a
database (let's say one view). I'm expecting that the server will honor it.
But right now postgresql server isn't.
This is the reason I'm writing here and tried too hackers list but no one
seems to understand the importance of this point.
Maybe it's my fault of knowledge but till now no one showed me how to get
the expected result, people try to tell me how to use firewall, change the
way of build my application, they don't understand the point. I'll repeat it
again:
When I create a postgresql user and grant to it only access to part of a
database (let's say one view). I'm expecting that the server will honor it.
But right now postgresql server isn't.
Actually any user with login access can see all
databases/roles/functions/table-definitions/triggers. What I thinks isn't
correct.
I'll apreciate any solution to this problem.
On Fri, Jun 27, 2008 at 3:44 PM, Lennin Caro <lennin.caro@yahoo.com> wrote:
> ok, let try this .....
>
> open the pg_hba.conf and check the line
>
> host all all 127.0.0.1/32 trust
>
> and change to
>
> host all all 127.0.0.1/32 password
>
>
>
> --- On *Thu, 6/26/08, Domingo Alvarez Duarte <mingodad@gmail.com>* wrote:
>
> From: Domingo Alvarez Duarte <mingodad@gmail.com>
> Subject: Re: [ADMIN] Extended security/restriction to any role with login
> access
> To: lennin.caro@yahoo.com
> Cc: "Carol Walter" <walterc@indiana.edu>, pgsql-admin@postgresql.org
> Date: Thursday, June 26, 2008, 9:45 PM
>
>
> I did the following:
> -Connect as superuser postgres with pgadmin and create a user -> noaccess
> CREATE ROLE noaccess LOGIN
> NOSUPERUSER NOINHERIT NOCREATEDB NOCREATEROLE;
>
> -Disconnect from the server
> -Connect to the server with user 'noaccess' through pgadmin3, and I can see
> all databases/functions/schemas/roles.
>
> What am I missing ?
>
> On Thu, Jun 26, 2008 at 8:44 PM, Lennin Caro <lennin.caro@yahoo.com>
> wrote:
>
>> hello...
>>
>> you can restric acces from all the databases in your cluster. When you use
>> pgadmin3 this show all the databases but if you dont have access to the
>> databases you cant see the struct of this.
>>
>> check waht user use pgadmin3 for connect to databases
>>
>> create groups and add privileges to the group later add the users to the
>> group
>>
>>
>>
>
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: mingodad@gmail.com, lennin.caro@yahoo.com, walterc@indiana.edu
Subject: Re: Extended security/restriction to any role with login access
In-Reply-To: <c2f38c3e0806270735l7a18d39et3e61a2c0a5ea4ecf@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox