From: "Wetmore, Matthew  (CTR)" <Matthew.Wetmore@express-scripts.com>
To: Tom Lane <tgl@sss.pgh.pa.us>,
        "martin.nguyen@oracle.com"
	<martin.nguyen@oracle.com>
CC: "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Thread-Topic: [EXTERNAL] Re: BUG #18350: Modifying predefined roles' unlimited
 connections for VA STIG cybersecurity checklist
Thread-Index: AQHaYSAi0Dn67mFvekSBfG5FPT10P7ENfkYw
Date: Fri, 16 Feb 2024 21:39:05 +0000
Message-ID: <bb120b6b4d524cec9842a931201c202f@express-scripts.com>
References: <18350-ed2d82ff23d8a7e3@postgresql.org>
 <3525669.1708119351@sss.pgh.pa.us>
In-Reply-To: <3525669.1708119351@sss.pgh.pa.us>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: BUG #18350: Modifying predefined roles' unlimited connections for VA
 STIG cybersecurity checklist
Archived-At: 
 <https://www.postgresql.org/message-id/bb120b6b4d524cec9842a931201c202f%40express-scripts.com>
Precedence: bulk

I think they mean the application connections from the UI to the backend, n=
ot backend SQL user login connection limits.

JAVA would be Hakari max_pool =3D 10 or something to that effect. =20

(I've been through this before), but you should check the requirement.

-----Original Message-----
From: Tom Lane <tgl@sss.pgh.pa.us>=20
Sent: Friday, February 16, 2024 1:36 PM
To: martin.nguyen@oracle.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: [EXTERNAL] Re: BUG #18350: Modifying predefined roles' unlimited c=
onnections for VA STIG cybersecurity checklist

PG Bug reporting form <noreply@postgresql.org> writes:
> We have identified an issue where predefined roles are not modifiable,=20
> however a Dept. of VA security checklist requires that no roles have=20
> unlimited connections. The Predefined roles have unlimited=20
> connections, is there a way to modify these?

Solution 1: explain to your compliance department that it's pointless to wo=
rry about the connection limit for a role that can't log in.

Solution 2: do a manual UPDATE on pg_authid.  This would have to be done ov=
er after any major-version upgrade, though.

			regards, tom lane