pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist
5+ messages / 5 participants
[nested] [flat]
* BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist
@ 2024-02-16 20:50 PG Bug reporting form <noreply@postgresql.org>
2024-02-16 21:32 ` Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist David G. Johnston <david.g.johnston@gmail.com>
2024-02-16 21:35 ` Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 2 replies; 5+ messages in thread
From: PG Bug reporting form @ 2024-02-16 20:50 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: martin.nguyen@oracle.com
The following bug has been logged on the website:
Bug reference: 18350
Logged by: Martin Nguyen
Email address: martin.nguyen@oracle.com
PostgreSQL version: 13.7
Operating system: RHEL
Description:
We have identified an issue where predefined roles are not modifiable,
however a Dept. of VA security checklist requires that no roles have
unlimited connections. The Predefined roles have unlimited connections, is
there a way to modify these?
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist
2024-02-16 20:50 BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist PG Bug reporting form <noreply@postgresql.org>
@ 2024-02-16 21:32 ` David G. Johnston <david.g.johnston@gmail.com>
1 sibling, 0 replies; 5+ messages in thread
From: David G. Johnston @ 2024-02-16 21:32 UTC (permalink / raw)
To: martin.nguyen@oracle.com; pgsql-bugs@lists.postgresql.org
On Fri, Feb 16, 2024 at 2:23 PM PG Bug reporting form <
noreply@postgresql.org> wrote:
> The following bug has been logged on the website:
>
> Bug reference: 18350
> Logged by: Martin Nguyen
> Email address: martin.nguyen@oracle.com
> PostgreSQL version: 13.7
> Operating system: RHEL
> Description:
>
> We have identified an issue where predefined roles are not modifiable,
> however a Dept. of VA security checklist requires that no roles have
> unlimited connections. The Predefined roles have unlimited connections, is
> there a way to modify these?
>
>
Pre-defined roles do not have the login attribute so the number of
connections attribute is irrelevant.
Superusers are not so constrained.
David J.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist
2024-02-16 20:50 BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist PG Bug reporting form <noreply@postgresql.org>
@ 2024-02-16 21:35 ` Tom Lane <tgl@sss.pgh.pa.us>
2024-02-16 21:39 ` BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com>
2024-02-19 01:02 ` Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist Andrew Dunstan <andrew@dunslane.net>
1 sibling, 2 replies; 5+ messages in thread
From: Tom Lane @ 2024-02-16 21:35 UTC (permalink / raw)
To: martin.nguyen@oracle.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> We have identified an issue where predefined roles are not modifiable,
> however a Dept. of VA security checklist requires that no roles have
> unlimited connections. The Predefined roles have unlimited connections, is
> there a way to modify these?
Solution 1: explain to your compliance department that it's pointless
to worry about the connection limit for a role that can't log in.
Solution 2: do a manual UPDATE on pg_authid. This would have to
be done over after any major-version upgrade, though.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist
2024-02-16 20:50 BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist PG Bug reporting form <noreply@postgresql.org>
2024-02-16 21:35 ` Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist Tom Lane <tgl@sss.pgh.pa.us>
@ 2024-02-16 21:39 ` Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com>
1 sibling, 0 replies; 5+ messages in thread
From: Wetmore, Matthew (CTR) @ 2024-02-16 21:39 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; martin.nguyen@oracle.com <martin.nguyen@oracle.com>; +Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
I think they mean the application connections from the UI to the backend, not backend SQL user login connection limits.
JAVA would be Hakari max_pool = 10 or something to that effect.
(I've been through this before), but you should check the requirement.
-----Original Message-----
From: Tom Lane <tgl@sss.pgh.pa.us>
Sent: Friday, February 16, 2024 1:36 PM
To: martin.nguyen@oracle.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: [EXTERNAL] Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist
PG Bug reporting form <noreply@postgresql.org> writes:
> We have identified an issue where predefined roles are not modifiable,
> however a Dept. of VA security checklist requires that no roles have
> unlimited connections. The Predefined roles have unlimited
> connections, is there a way to modify these?
Solution 1: explain to your compliance department that it's pointless to worry about the connection limit for a role that can't log in.
Solution 2: do a manual UPDATE on pg_authid. This would have to be done over after any major-version upgrade, though.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist
2024-02-16 20:50 BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist PG Bug reporting form <noreply@postgresql.org>
2024-02-16 21:35 ` Re: BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist Tom Lane <tgl@sss.pgh.pa.us>
@ 2024-02-19 01:02 ` Andrew Dunstan <andrew@dunslane.net>
1 sibling, 0 replies; 5+ messages in thread
From: Andrew Dunstan @ 2024-02-19 01:02 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; martin.nguyen@oracle.com; +Cc: pgsql-bugs@lists.postgresql.org
On 2024-02-16 Fr 16:35, Tom Lane wrote:
> PG Bug reporting form <noreply@postgresql.org> writes:
>> We have identified an issue where predefined roles are not modifiable,
>> however a Dept. of VA security checklist requires that no roles have
>> unlimited connections. The Predefined roles have unlimited connections, is
>> there a way to modify these?
> Solution 1: explain to your compliance department that it's pointless
> to worry about the connection limit for a role that can't log in.
>
> Solution 2: do a manual UPDATE on pg_authid. This would have to
> be done over after any major-version upgrade, though.
>
>
Also note that this is not by any stretch of the imagination a bug.
cheers
andrew
--
Andrew Dunstan
EDB: https://www.enterprisedb.com
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2024-02-19 01:02 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2024-02-16 20:50 BUG #18350: Modifying predefined roles' unlimited connections for VA STIG cybersecurity checklist PG Bug reporting form <noreply@postgresql.org>
2024-02-16 21:32 ` David G. Johnston <david.g.johnston@gmail.com>
2024-02-16 21:35 ` Tom Lane <tgl@sss.pgh.pa.us>
2024-02-16 21:39 ` Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com>
2024-02-19 01:02 ` Andrew Dunstan <andrew@dunslane.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox