Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hPrLO-0002Ae-4X for pgsql-docs@arkaria.postgresql.org; Sun, 12 May 2019 16:28:58 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hPrLM-0001v7-IL for pgsql-docs@arkaria.postgresql.org; Sun, 12 May 2019 16:28:56 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hPrLM-0001v0-6x for pgsql-docs@lists.postgresql.org; Sun, 12 May 2019 16:28:56 +0000 Received: from meldrar.postgresql.org ([2a02:c0:301:0:ffff::31]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hPrLJ-0002b7-8U for pgsql-docs@lists.postgresql.org; Sun, 12 May 2019 16:28:54 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Content-Type:MIME-Version:Date:Message-ID:To: Subject:From:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=Qz5kW08DX1+L0RYjF6qFbneMpR/ZG+vvyvO27b1gxxU=; b=D6/s/7/G/BdvKcXJ7JeV+YzTtS rQ2wSTvqUhmrWqR2+3u6hSz9IaSh1pMKll/+pSI6385CNj6Arzl/zGvqLxn+NneqaXNJ3ik5TEGCO wiDa8AFvY0YYKHGPQSnO8PQtJ7G2KSpSmClsMYSrHZQv0YzYnDbaeCluxfWmXdH6uGaXGUOI1pavM GrdvnKgUySHqza/BBElEiOJzlR14fagKRnJ1b4U5tI5tOKp1KAeeNOEwlAjqY/6Cjs+hg1rtUPd2u uxMcSQic34QG+ZGK3b7546lRm/af5KgQS+K5xWUzK+PVAGlz49KOgazZMxroaB9s2h9+grmDT/Crk kAAZd4dw==; Received: from pool-96-250-83-19.nycmny.fios.verizon.net ([96.250.83.19] helo=Ph33r-Retina.home) by meldrar.postgresql.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hPrLF-0001BL-0W for pgsql-docs@lists.postgresql.org; Sun, 12 May 2019 16:28:51 +0000 From: "Jonathan S. Katz" Subject: Additional "Creating a Cluster" Guidance for Windows Users Openpgp: preference=signencrypt Autocrypt: addr=jkatz@postgresql.org; keydata= mQINBFtShwABEAC7PNHDUOTYuifpUCk23KqfxdQQkn4nkoxOXRK0+rAj36FiwqGB4TJFuOVZ sDFAEiSlC8Jt4y5Cs7B5tetT8JNd2cs6zp/udMJJDz9d65O9PDpdlMgAmIiTzpLlSdx8FG56 DTksaDv1d8j3cTJPSE4/fWSxqzA7o3Y9UuL7atZPrzfImgpRKs0of7elIHwOa8GucjyhYqcR h60wFBJc2KXqQdDYRTZy43DSnY/0VNc0omiH355fustvpm+m5HjD3w7qZyfN3fpKJpnX1LCF f3MnPHaDGITIYGRCBXvf0UqUtD6OEVWPv2C2gyqWMIpWmZTOgDufltKyIByKBoS9x0PlFkij 04X3KODCngt+N8Ssc9OICc6QSxhjoP48PYPdmiTmkrGuf0LX084wj1xeo1NX7XxZK39F6dTJ DhsIiW0sNS0xMxQHLHG9VLbPjx3SANQBh6BuryPz5ZupW9/TIDmkvprtU/oXfKgtfYm3fxmk EctxbWrEPsFTFPyuMqQu6l+xyQv0s1VLZfjNWaua6H1/gGoIt6kRnn5qMXDVVpijuWkHbv7G ngaQMd258UrrOEHnnjzhQ7jxMWV9D+emxbAtlIxnYvCWlV4IwAQhEHfvudqYaIY3hNWrvQ6H GB2KXoTZYN9g5djm14/5nj1IU5zOcovkjJnKhoo9iStnpFF2cwARAQABtCdKb25hdGhhbiBT LiBLYXR6IDxqa2F0ekBwb3N0Z3Jlc3FsLm9yZz6JAlQEEwEIAD4CGwMFCQeGH4AFCwkIBwIG FQoJCAsCBBYCAwECHgECF4AWIQT6hLaVryv3miBkP/HxBJxynxxlJwUCW1KJJQAKCRDxBJxy nxxlJwjrD/kBgqsW4QpNpTFw7ifRokZV08CCX4huPBJQ91rrv+UEWlEcotFBHVkYyHnpzARl tcZxhJ9CbFxjniH9cOTty5T/O1yolbOHtZSW8Z8aWV6BVEbjMb+BFxSSLm7RnvJdzQbGCZq2 ZZvfVpB6z3EHYph4KDdVKvMFjoLskxmdS1DE0tE3zTxvoQsi24Q+HOS07kUjs6fsu/WICMfz mgO++AWG9Y0CvN0mm4TkujESzyKM9E5irD+leEMIcddl51Aa2c/VMfBXQbRmpHIgUFTmuHQD CnQih+9i3OJAksDg66SP8a7yiXv5mwvyDi1EfTGVKYR2j+pwyjwnC3oIbvDMmB3uTn2JIjnT iZKPVtAcAylXjubFltihQgNyuShdP4W+kBwZizhUFqUVL8Anx+KoytYmJPfMRFLGuK4obXKq a2ZS3k9KB+H+isOx2nFJOsc7V360Zp1DVaNmuiK10TT6QndShSPaqkJqFtCb6r92rZ9sZM/L 3vtCI4Rrl3Pt1MgtENXupS8gZpJnAYS0j5A1PAZ09r6ANoaeMHspF+5J5fOHeEvqphXr36mm a83Vl1t4orPb0+QmmijmlpseDU63M88Aw5p3c4qj7t8Qr2EZ5zrn7/sFn5wOfbs8Nymxafif QCnlV2vg9p0m7vSk/yLJ4PFZvs52FgqAGRCdRn0s2EC99bkCDQRbUocAARAAv8ho/toQ9DG3 j4f9h9n1aRHr2FlviN2Utpy6L8+dfDggO0geilmkGQOolZ2E60gGfye/kUtF9W3NByO4hxDR 9u6qbOXcdqnuA+cc68EfqlWFJrVtYFxt0h4ElWYOYnIezKthriWch/FY70FGrxs3z8UHOHq5 0wBW433eTvZm90WixBiXEt2v1DgW4Vr3ymfO7Aap/IYyPuE4JzgudAuAl0HKPyNEHWHG1dAb jX1RiCw9gknIDWQOF0B4UAaJctWGVcnZ3A2ULwNGMa1P9ZJlBWf1vcj01aiHMU0yQ7JjJiSp vfm9eM0uSLwRdDrJjyl5ZZqVumjdv2SMNQ8GvYRbEMys3GGDSt9zXgfCSUnPnJfYxjzBHRI6 x44Wfsx8S6hWxepOogCJJ/g67Bk9mY8YV4klWIXDJVOL5jnBC09DbsZG81JaE2QxB8Y7W36Z Mroi9XMxg3s805hQAQUvdG/poU8hN8BWdrnTm/+4eQQp7gDY1ePDmGM6bJC+OHOSnFtR/f+7 0zpKJ10cc7cBygGnl1yR3KjhFyAWUFvP4ZGziKCcpMwXZfe9PGuyA/YOubMphxIn3YsK2wrd faKZYX2GMZCZhMMcvx9IpQrxIJgU+VlwXu/O+Lk10VIPcxPJJwmpdI6HzcS8ZgG6IMcC444X XTuLaP8j2mgcMvYak3ScCykAEQEAAYkCPAQYAQgAJhYhBPqEtpWvK/eaIGQ/8fEEnHKfHGUn BQJbUocAAhsMBQkHhh+AAAoJEPEEnHKfHGUnReMP/RA2UhGQj+G4uBshkRLjpRysabdPqgQB dEBk6wYbio88Wg/2/hgY7UzmDDEwX3sZfQDcrI6+vIobI8uqstZID+WgAAa1JLfChMyVQnSy 0zfWMOABXscc5tGuvFRZvJklTissMFjXUwaREEKp4ZikTvJ/62MCjSdtrUhnPLvoTsHTKRKD ichE+b5A54alwsubTijw12O6N22r5IjZiiSZV0u7dsShyKw+7wCSax9fuBoE43NMYf+dnjMK nerAQYUcZWYMnk+EC8RaqYAxv6XZ2tKx1AkGGktwkQIBwrz9IlDSvJ3LWJ2UIIuLRTdngNgg GIL4zzuUa2F56FqskQIuYMaNETk6LYfalBDQ6TVLAcgCPQxp4k4i/PRsZ3lZ2ZhRHRYciOvm kp+I6EfHwllQpYrWs1thluBGqlJSVJgKl0IOFvKLsQ6KKfqzAwh6FxrO5qajp4viNIgtWoFw O5Bp0jgFTbH2OrMWIRfUdUCH1Djbuo65svhNj7FNsQVYzHDI+Nd1I/LOBoPc3UorRMF2M4JV kUR7skOHWUbPTSNUr7qc14NSMY3PKjGeVGAsBVHBPvmRx/Ss2tW/TpJWpxg4pmquFQSXuaYh Yf4FN8Sxy320pcr+FqN8AhZkYJcNY82OTtR5VEKRC/mYcyq61qXIKqngydn79bJjGxHipxyF FmEC To: Pg Docs Message-ID: <5e25223c-700d-3559-a7af-cf15941b093d@postgresql.org> Date: Sun, 12 May 2019 12:28:47 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="s87z5E2VxvtfwG9cFgMvCVthx15iZfU5h" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --s87z5E2VxvtfwG9cFgMvCVthx15iZfU5h Content-Type: multipart/mixed; boundary="nSw4mCgZGNtxdf1bfNVN7RjiKYaKoQ1A9"; protected-headers="v1" From: "Jonathan S. Katz" To: Pg Docs Message-ID: <5e25223c-700d-3559-a7af-cf15941b093d@postgresql.org> Subject: Additional "Creating a Cluster" Guidance for Windows Users --nSw4mCgZGNtxdf1bfNVN7RjiKYaKoQ1A9 Content-Type: multipart/mixed; boundary="------------75B92CB42E5F76052A720184" Content-Language: en-US This is a multi-part message in MIME format. --------------75B92CB42E5F76052A720184 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, Per the last update release[1] I was going through some of our documentation around creating clusters and noticed that we may want to provide a bit more guidance around creating clusters on Windows: https://www.postgresql.org/docs/current/creating-cluster.html i.e.: "Because the data directory contains all the data stored in the database, it is essential that it be secured from unauthorized access. initdb therefore revokes access permissions from everyone but the PostgreSQL user, and optionally, group." However, this does not explicitly state that initdb performs this revocation only for *non-Windows systems* -- to lock down the data directory after an initdb run on a Windows system, it requires manual intervention. I've attached a patch that explicitly states the above. I wrapped the guidance in a "Warning" box given the data directory is exposed if not locked down properly. I would also recommend this is backpatched to 9.4. If in agreement on the above methodology + wording, I can generate the backpatches. Thanks, Jonathan [1] https://www.postgresql.org/about/news/1939/ --------------75B92CB42E5F76052A720184 Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="initdb-win-v1.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="initdb-win-v1.patch" ZGlmZiAtLWdpdCBhL2RvYy9zcmMvc2dtbC9ydW50aW1lLnNnbWwgYi9kb2Mvc3JjL3NnbWwv cnVudGltZS5zZ21sCmluZGV4IGU3ODQyNjg1MTIuLjJjYTQ5ZDI0ODIgMTAwNjQ0Ci0tLSBh L2RvYy9zcmMvc2dtbC9ydW50aW1lLnNnbWwKKysrIGIvZG9jL3NyYy9zZ21sL3J1bnRpbWUu c2dtbApAQCAtMTM1LDE0ICsxMzUsMjMgQEAgcG9zdGdyZXMkIDx1c2VyaW5wdXQ+aW5pdGRi IC1EIC91c3IvbG9jYWwvcGdzcWwvZGF0YTwvdXNlcmlucHV0PgogICA8cGFyYT4KICAgIEJl Y2F1c2UgdGhlIGRhdGEgZGlyZWN0b3J5IGNvbnRhaW5zIGFsbCB0aGUgZGF0YSBzdG9yZWQg aW4gdGhlCiAgICBkYXRhYmFzZSwgaXQgaXMgZXNzZW50aWFsIHRoYXQgaXQgYmUgc2VjdXJl ZCBmcm9tIHVuYXV0aG9yaXplZAotICAgYWNjZXNzLiA8Y29tbWFuZD5pbml0ZGI8L2NvbW1h bmQ+IHRoZXJlZm9yZSByZXZva2VzIGFjY2VzcwotICAgcGVybWlzc2lvbnMgZnJvbSBldmVy eW9uZSBidXQgdGhlCisgICBhY2Nlc3MuIE9uIGFsbCBvcGVyYXRpbmcgc3lzdGVtcyBvdGhl ciB0aGFuIFdpbmRvd3MsCisgICA8Y29tbWFuZD5pbml0ZGI8L2NvbW1hbmQ+IHJldm9rZXMg YWNjZXNzIHBlcm1pc3Npb25zIGZyb20gZXZlcnlvbmUgYnV0IHRoZQogICAgPHByb2R1Y3Ru YW1lPlBvc3RncmVTUUw8L3Byb2R1Y3RuYW1lPiB1c2VyLCBhbmQgb3B0aW9uYWxseSwgZ3Jv dXAuCiAgICBHcm91cCBhY2Nlc3MsIHdoZW4gZW5hYmxlZCwgaXMgcmVhZC1vbmx5LiAgVGhp cyBhbGxvd3MgYW4gdW5wcml2aWxlZ2VkCiAgICB1c2VyIGluIHRoZSBzYW1lIGdyb3VwIGFz IHRoZSBjbHVzdGVyIG93bmVyIHRvIHRha2UgYSBiYWNrdXAgb2YgdGhlCiAgICBjbHVzdGVy IGRhdGEgb3IgcGVyZm9ybSBvdGhlciBvcGVyYXRpb25zIHRoYXQgb25seSByZXF1aXJlIHJl YWQgYWNjZXNzLgogICA8L3BhcmE+CiAKKyAgPHdhcm5pbmc+CisgICA8cGFyYT4KKyAgIElm IHlvdSBhcmUgcnVubmluZyBQb3N0Z3JlU1FMIG9uIFdpbmRvd3MgYW5kIGNyZWF0ZSB5b3Vy IGNsdXN0ZXIgdXNpbmcKKyAgIDxjb21tYW5kPmluaXRkYjwvY29tbWFuZD4sIHlvdSB3aWxs IG5lZWQgdG8gc2V0IHRoZSBwZXJtaXNzaW9ucyBvbiB0aGUgZGF0YQorICAgZGlyZWN0b3J5 IG1hbnVhbGx5LiBZb3Ugc2hvdWxkIHJldm9rZSBhbGwgdXNlciBhY2Nlc3MgdG8gdGhlIGRh dGEgZGlyZWN0b3J5CisgICBleGNlcHQgZm9yIHRoZSA8cHJvZHVjdG5hbWU+UG9zdGdyZVNR TDwvcHJvZHVjdG5hbWU+IHVzZXIuCisgICA8L3BhcmE+CisgIDwvd2FybmluZz4KKwogICA8 cGFyYT4KICAgIE5vdGUgdGhhdCBlbmFibGluZyBvciBkaXNhYmxpbmcgZ3JvdXAgYWNjZXNz IG9uIGFuIGV4aXN0aW5nIGNsdXN0ZXIgcmVxdWlyZXMKICAgIHRoZSBjbHVzdGVyIHRvIGJl IHNodXQgZG93biBhbmQgdGhlIGFwcHJvcHJpYXRlIG1vZGUgdG8gYmUgc2V0IG9uIGFsbAo= --------------75B92CB42E5F76052A720184-- --nSw4mCgZGNtxdf1bfNVN7RjiKYaKoQ1A9-- --s87z5E2VxvtfwG9cFgMvCVthx15iZfU5h Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE+oS2la8r95ogZD/x8QSccp8cZScFAlzYSb8ACgkQ8QSccp8c ZSdNzQ/8CD04goilB06PACXQlWs4LjDRbg6Bwa7rKgZ18bA7q7PhwCQymwccV4fR 2tFpM/bQZOtecUOFW8AAW3XJAIfVpG+32mwEoroKeRNVUU525j3uBNeBBV3iDKb4 iGx8cPN3jFwRPPDKB1nmTmFDoG8SccV42FXUuZt5GQcmBuNNgJ/sKw2lkq0uTGWy Md3l+pOeTfTE0doewWlHIJFlnbjrOmDzs1DpPtTS+YvPp1Tr7BWWRbgczjlcz4tf bszJ0t01xmQE1N1dbUvvdATUGLRFx54NCvcT2sd/AqJHRW6EWwcH12hwvtZMY3tE 8Whz4/m69IJfPfiA37JxxT1tI+cQetRNluKtcZJlKjCBGGqWVnFd+sOHnEI5vURY uFDtQBKnLD7Heks4mZ4BWIYMAhfV/K7L4Pqx4LhoUQYRPQToWCvFswkAKAVyW6+l EGmu3Tn2N90zg+I6a54YzOvVH09ZUUEYCZB27bO6Mhhoy30F47EYipXgx/9ZLifv lhykeF/GdOp7/nvFKuXHhsqnjyo5NovstI26gH//GwbhfNoZ+pY05XZkaNLgI2Il 3kg6/RX0InDIi/NrG3SB28Q6XjTKC6Z/OmFBsbPBn8k+tgg5gHG6KncgTWVqmSAd yD6Oku66sT+835EaXGF4PxyXMbYf0ctcXflWTinsMgwzQ/b0fYU= =lqY1 -----END PGP SIGNATURE----- --s87z5E2VxvtfwG9cFgMvCVthx15iZfU5h--