pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedRoles for pg_basebackup
7+ messages / 3 participants
[nested] [flat]
Commits from this thread:
2020-05-05 c5114e42fa Doc: Outline REPLICATION before SUPERUSER privilege
* Roles for pg_basebackup
@ 2020-04-27 10:16 Daniel Gustafsson <daniel@yesql.se>
2020-04-28 04:37 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
0 siblings, 1 reply; 7+ messages in thread
From: Daniel Gustafsson @ 2020-04-27 10:16 UTC (permalink / raw)
To: pgsql-docs@lists.postgresql.org
Based on a recent conversation about backups I had I propose a small tweak to
the pg_basebackup documentation. Listing the user types in the reverse order
from today, putting superuser last, makes it IMO a little clearer that a
REPLICATION role is preferrable to using a superuser for running backups.
cheers ./daniel
Attachments:
pg_basebackup_user.diff (application/octet-stream, 878B) download
diff --git a/doc/src/sgml/ref/pg_basebackup.sgml b/doc/src/sgml/ref/pg_basebackup.sgml
index 01ce44ee22..12fadabfb8 100644
--- a/doc/src/sgml/ref/pg_basebackup.sgml
+++ b/doc/src/sgml/ref/pg_basebackup.sgml
@@ -51,8 +51,8 @@ PostgreSQL documentation
<para>
The backup is made over a regular <productname>PostgreSQL</productname>
connection, and uses the replication protocol. The connection must be made
- with a superuser or a user having <literal>REPLICATION</literal>
- permissions (see <xref linkend="role-attributes"/>),
+ with a user having <literal>REPLICATION</literal> permissions
+ (see <xref linkend="role-attributes"/>) or a superuser,
and <filename>pg_hba.conf</filename> must explicitly permit the replication
connection. The server must also be configured
with <xref linkend="guc-max-wal-senders"/> set high enough to leave at least
* Re: Roles for pg_basebackup
2020-04-27 10:16 Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
@ 2020-04-28 04:37 ` Michael Paquier <michael@paquier.xyz>
2020-04-28 05:22 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
0 siblings, 1 reply; 7+ messages in thread
From: Michael Paquier @ 2020-04-28 04:37 UTC (permalink / raw)
To: Daniel Gustafsson <daniel@yesql.se>; +Cc: pgsql-docs@lists.postgresql.org
On Mon, Apr 27, 2020 at 12:16:41PM +0200, Daniel Gustafsson wrote:
> Based on a recent conversation about backups I had I propose a small tweak to
> the pg_basebackup documentation. Listing the user types in the reverse order
> from today, putting superuser last, makes it IMO a little clearer that a
> REPLICATION role is preferrable to using a superuser for running backups.
Makes sense to me. We do that in logical-replication.sgml as well as
pg_rewind.sgml (the latter outlines superuser rights last).
Any objections from others?
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Roles for pg_basebackup
2020-04-27 10:16 Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-04-28 04:37 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
@ 2020-04-28 05:22 ` Fujii Masao <masao.fujii@oss.nttdata.com>
2020-04-28 08:15 ` Re: Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
0 siblings, 1 reply; 7+ messages in thread
From: Fujii Masao @ 2020-04-28 05:22 UTC (permalink / raw)
To: Michael Paquier <michael@paquier.xyz>; Daniel Gustafsson <daniel@yesql.se>; +Cc: pgsql-docs@lists.postgresql.org
On 2020/04/28 13:37, Michael Paquier wrote:
> On Mon, Apr 27, 2020 at 12:16:41PM +0200, Daniel Gustafsson wrote:
>> Based on a recent conversation about backups I had I propose a small tweak to
>> the pg_basebackup documentation. Listing the user types in the reverse order
>> from today, putting superuser last, makes it IMO a little clearer that a
>> REPLICATION role is preferrable to using a superuser for running backups.
>
> Makes sense to me. We do that in logical-replication.sgml as well as
> pg_rewind.sgml (the latter outlines superuser rights last).
Seems there are other documentations having the similar description,
for example, pg_receivewal.sgml, func.sgml and high-availability.sgml.
Isn't it better to update also them at the same time?
> Any objections from others?
No.
Regards,
--
Fujii Masao
Advanced Computing Technology Center
Research and Development Headquarters
NTT DATA CORPORATION
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Roles for pg_basebackup
2020-04-27 10:16 Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-04-28 04:37 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
2020-04-28 05:22 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
@ 2020-04-28 08:15 ` Daniel Gustafsson <daniel@yesql.se>
2020-05-01 03:29 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
0 siblings, 1 reply; 7+ messages in thread
From: Daniel Gustafsson @ 2020-04-28 08:15 UTC (permalink / raw)
To: Fujii Masao <masao.fujii@oss.nttdata.com>; +Cc: Michael Paquier <michael@paquier.xyz>; pgsql-docs@lists.postgresql.org
> On 28 Apr 2020, at 07:22, Fujii Masao <masao.fujii@oss.nttdata.com> wrote:
>
> On 2020/04/28 13:37, Michael Paquier wrote:
>> On Mon, Apr 27, 2020 at 12:16:41PM +0200, Daniel Gustafsson wrote:
>>> Based on a recent conversation about backups I had I propose a small tweak to
>>> the pg_basebackup documentation. Listing the user types in the reverse order
>>> from today, putting superuser last, makes it IMO a little clearer that a
>>> REPLICATION role is preferrable to using a superuser for running backups.
>> Makes sense to me. We do that in logical-replication.sgml as well as
>> pg_rewind.sgml (the latter outlines superuser rights last).
>
> Seems there are other documentations having the similar description,
> for example, pg_receivewal.sgml, func.sgml and high-availability.sgml.
> Isn't it better to update also them at the same time?
That doe make sense. I've updated the places where I think a user configuring
the system might conceivably infer a preference from the order, but have left
the other ones as is.
cheers ./daniel
Attachments:
pg_basebackup_user-v2.diff (application/octet-stream, 2.9K) download
diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml
index 52e47379cc..31cb8e6795 100644
--- a/doc/src/sgml/high-availability.sgml
+++ b/doc/src/sgml/high-availability.sgml
@@ -827,8 +827,8 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r'
It is very important that the access privileges for replication be set up
so that only trusted users can read the WAL stream, because it is
easy to extract privileged information from it. Standby servers must
- authenticate to the primary as a superuser or an account that has the
- <literal>REPLICATION</literal> privilege. It is recommended to create a
+ authenticate to the primary as an account that has the
+ <literal>REPLICATION</literal> privilege or a superuser. It is recommended to create a
dedicated user account with <literal>REPLICATION</literal> and <literal>LOGIN</literal>
privileges for replication. While <literal>REPLICATION</literal> privilege gives
very high permissions, it does not allow the user to modify any data on
diff --git a/doc/src/sgml/ref/pg_basebackup.sgml b/doc/src/sgml/ref/pg_basebackup.sgml
index 01ce44ee22..12fadabfb8 100644
--- a/doc/src/sgml/ref/pg_basebackup.sgml
+++ b/doc/src/sgml/ref/pg_basebackup.sgml
@@ -51,8 +51,8 @@ PostgreSQL documentation
<para>
The backup is made over a regular <productname>PostgreSQL</productname>
connection, and uses the replication protocol. The connection must be made
- with a superuser or a user having <literal>REPLICATION</literal>
- permissions (see <xref linkend="role-attributes"/>),
+ with a user having <literal>REPLICATION</literal> permissions
+ (see <xref linkend="role-attributes"/>) or a superuser,
and <filename>pg_hba.conf</filename> must explicitly permit the replication
connection. The server must also be configured
with <xref linkend="guc-max-wal-senders"/> set high enough to leave at least
diff --git a/doc/src/sgml/ref/pg_receivewal.sgml b/doc/src/sgml/ref/pg_receivewal.sgml
index febfc0ba13..877c289a75 100644
--- a/doc/src/sgml/ref/pg_receivewal.sgml
+++ b/doc/src/sgml/ref/pg_receivewal.sgml
@@ -68,9 +68,9 @@ PostgreSQL documentation
<para>
The write-ahead log is streamed over a regular
<productname>PostgreSQL</productname> connection and uses the replication
- protocol. The connection must be made with a superuser or a user
- having <literal>REPLICATION</literal> permissions (see
- <xref linkend="role-attributes"/>), and <filename>pg_hba.conf</filename>
+ protocol. The connection must be made with a user having
+ <literal>REPLICATION</literal> permissions (see
+ <xref linkend="role-attributes"/>) or a superuser, and <filename>pg_hba.conf</filename>
must permit the replication connection. The server must also be
configured with <xref linkend="guc-max-wal-senders"/> set high enough to
leave at least one session available for the stream.
* Re: Roles for pg_basebackup
2020-04-27 10:16 Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-04-28 04:37 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
2020-04-28 05:22 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
2020-04-28 08:15 ` Re: Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
@ 2020-05-01 03:29 ` Fujii Masao <masao.fujii@oss.nttdata.com>
2020-05-03 06:53 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
0 siblings, 1 reply; 7+ messages in thread
From: Fujii Masao @ 2020-05-01 03:29 UTC (permalink / raw)
To: Daniel Gustafsson <daniel@yesql.se>; +Cc: Michael Paquier <michael@paquier.xyz>; pgsql-docs@lists.postgresql.org
On 2020/04/28 17:15, Daniel Gustafsson wrote:
>> On 28 Apr 2020, at 07:22, Fujii Masao <masao.fujii@oss.nttdata.com> wrote:
>>
>> On 2020/04/28 13:37, Michael Paquier wrote:
>>> On Mon, Apr 27, 2020 at 12:16:41PM +0200, Daniel Gustafsson wrote:
>>>> Based on a recent conversation about backups I had I propose a small tweak to
>>>> the pg_basebackup documentation. Listing the user types in the reverse order
>>>> from today, putting superuser last, makes it IMO a little clearer that a
>>>> REPLICATION role is preferrable to using a superuser for running backups.
>>> Makes sense to me. We do that in logical-replication.sgml as well as
>>> pg_rewind.sgml (the latter outlines superuser rights last).
>>
>> Seems there are other documentations having the similar description,
>> for example, pg_receivewal.sgml, func.sgml and high-availability.sgml.
>> Isn't it better to update also them at the same time?
>
> That doe make sense. I've updated the places where I think a user configuring
> the system might conceivably infer a preference from the order, but have left
> the other ones as is.
Thanks for updating the patch! It looks good to me.
Regards,
--
Fujii Masao
Advanced Computing Technology Center
Research and Development Headquarters
NTT DATA CORPORATION
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Roles for pg_basebackup
2020-04-27 10:16 Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-04-28 04:37 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
2020-04-28 05:22 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
2020-04-28 08:15 ` Re: Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-05-01 03:29 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
@ 2020-05-03 06:53 ` Michael Paquier <michael@paquier.xyz>
2020-05-05 05:17 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
0 siblings, 1 reply; 7+ messages in thread
From: Michael Paquier @ 2020-05-03 06:53 UTC (permalink / raw)
To: Fujii Masao <masao.fujii@oss.nttdata.com>; +Cc: Daniel Gustafsson <daniel@yesql.se>; pgsql-docs@lists.postgresql.org
On Fri, May 01, 2020 at 12:29:09PM +0900, Fujii Masao wrote:
> On 2020/04/28 17:15, Daniel Gustafsson wrote:
>> That does make sense. I've updated the places where I think a user configuring
>> the system might conceivably infer a preference from the order, but have left
>> the other ones as is.
Yeah, I spotted a couple of places in adminpack.sgml, dropuser.sgml,
catalogs.sgml and config.sgml, but the intention looks different. We
could always discuss more on that later on.
> Thanks for updating the patch! It looks good to me.
Fine for me as well as far as it goes. I'll go apply it if there are
no objections.
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Roles for pg_basebackup
2020-04-27 10:16 Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-04-28 04:37 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
2020-04-28 05:22 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
2020-04-28 08:15 ` Re: Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-05-01 03:29 ` Re: Roles for pg_basebackup Fujii Masao <masao.fujii@oss.nttdata.com>
2020-05-03 06:53 ` Re: Roles for pg_basebackup Michael Paquier <michael@paquier.xyz>
@ 2020-05-05 05:17 ` Michael Paquier <michael@paquier.xyz>
0 siblings, 0 replies; 7+ messages in thread
From: Michael Paquier @ 2020-05-05 05:17 UTC (permalink / raw)
To: Fujii Masao <masao.fujii@oss.nttdata.com>; +Cc: Daniel Gustafsson <daniel@yesql.se>; pgsql-docs@lists.postgresql.org
On Sun, May 03, 2020 at 03:53:31PM +0900, Michael Paquier wrote:
> Fine for me as well as far as it goes. I'll go apply it if there are
> no objections.
And done.
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2020-05-05 05:17 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-04-27 10:16 Roles for pg_basebackup Daniel Gustafsson <daniel@yesql.se>
2020-04-28 04:37 ` Michael Paquier <michael@paquier.xyz>
2020-04-28 05:22 ` Fujii Masao <masao.fujii@oss.nttdata.com>
2020-04-28 08:15 ` Daniel Gustafsson <daniel@yesql.se>
2020-05-01 03:29 ` Fujii Masao <masao.fujii@oss.nttdata.com>
2020-05-03 06:53 ` Michael Paquier <michael@paquier.xyz>
2020-05-05 05:17 ` Michael Paquier <michael@paquier.xyz>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox