Received: from maia.hub.org (maia-2.hub.org [200.46.204.251]) by mail.postgresql.org (Postfix) with ESMTP id 198541337B4F for ; Tue, 4 Jan 2011 15:48:10 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by maia.hub.org (mx1.hub.org [200.46.204.251]) (amavisd-maia, port 10024) with ESMTP id 52097-09 for ; Tue, 4 Jan 2011 19:48:02 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from mail-iw0-f174.google.com (mail-iw0-f174.google.com [209.85.214.174]) by mail.postgresql.org (Postfix) with ESMTP id D13301337B39 for ; Tue, 4 Jan 2011 15:48:01 -0400 (AST) Received: by iwn9 with SMTP id 9so14595730iwn.19 for ; Tue, 04 Jan 2011 11:48:01 -0800 (PST) Received: by 10.42.172.197 with SMTP id o5mr22753574icz.422.1294169996532; Tue, 04 Jan 2011 11:39:56 -0800 (PST) Received: from tech304 (supranet-tech.secure-on.net [66.170.8.18]) by mx.google.com with ESMTPS id ca7sm11702419icb.12.2011.01.04.11.39.55 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 04 Jan 2011 11:39:55 -0800 (PST) Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes To: pgsql-admin@postgresql.org Subject: Re: pgadmin user access control features References: <24001946.1624.1294160696171.JavaMail.root@mail.nextwavesys.com> Date: Tue, 04 Jan 2011 13:39:54 -0600 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Mark Felder" Message-ID: In-Reply-To: <24001946.1624.1294160696171.JavaMail.root@mail.nextwavesys.com> User-Agent: Opera Mail/11.00 (FreeBSD) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-2.6 tagged_above=-10 required=5 tests=BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7 X-Spam-Level: X-Archive-Number: 201101/36 X-Sequence-Number: 36476 On Tue, 04 Jan 2011 11:04:56 -0600, Dan Sabin wrote: > The two options are to give them a query tool we design so we can > restrict their actions (to prevent the database from being screwed up). If their user still has access to doing other things it might be possible for that data to be modified using regular postgres tools, which is a a security risk of sorts. Perhaps it might be best for you to setup certain functions or stored procedures that their database user only has access to? I assume this is possible, anyway. Regards, Mark