From: Hauke Lampe <lampe@tucco.de>
To: pgsql-general@postgresql.org
Subject: Re: Client/Server Security question
Date: Sun, 22 Apr 2001 05:36:26 +0200
Message-ID: <20010422053626.A13721@tucco.de> (raw)
In-Reply-To: <20010420150426.45854.qmail@web12502.mail.yahoo.com>
References: <20010420150426.45854.qmail@web12502.mail.yahoo.com>
Lonnie Cumberland [lonnie_cumberland@yahoo.com] wrote:
> In the interest of security, I am wondering if it is possible to turn off some
> of the functions in the SQL command list such that a user can only communicate
> to the database through our functions.
I suggest using a specialised SQL Proxy on the entry gateway that allows
only a certain set of SQL functions from one host and relays the to the
DB inside. This ensures that possibly dangerous commands like 'DROP' or
'CREATE USER' will never reach the DB regardless of the permissions of
the username used by the proxy.
I don't know of any existing (postgre-)sql proxy solutions yet, though.
> but I only want to allow an outside
> query to only one or two of our selected entry points.
Set appropiate packet filtering rules on both the webserver and the
entry point(s).
HTH,
Hauke
--
Hauke Lampe - TUCCO - The Universal Communication Company
http://www.tucco.de - fon: +49-40-65777-510, fax: +40-40-65777-250
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: lampe@tucco.de, pgsql-general@postgresql.org
Subject: Re: Client/Server Security question
In-Reply-To: <20010422053626.A13721@tucco.de>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox