Received: from maia.hub.org (unknown [200.46.204.183])
	by mail.postgresql.org (Postfix) with ESMTP id AD921633EB5
	for <pgsql-sql-postgresql.org@mail.postgresql.org>;
	Thu, 11 Mar 2010 18:21:07 -0400 (AST)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.183]) (amavisd-maia,
	port 10024) with ESMTP id 85458-08 for
	<pgsql-sql-postgresql.org@mail.postgresql.org>;
	Thu, 11 Mar 2010 22:20:56 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-pz0-f197.google.com (mail-pz0-f197.google.com
	[209.85.222.197])
	by mail.postgresql.org (Postfix) with ESMTP id A0E5B633D6D
	for <pgsql-sql@postgresql.org>; Thu, 11 Mar 2010 18:20:56 -0400 (AST)
Received: by pzk35 with SMTP id 35so303000pzk.28
	for <pgsql-sql@postgresql.org>; Thu, 11 Mar 2010 14:20:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:received:in-reply-to:references
	:date:message-id:subject:from:to:cc:content-type;
	bh=0p3YCJCexTM1sVKYcIXTkwqwrI5RFcEeab8n6xEqLM0=;
	b=gHH9T/3jwXxkAzqi3bscb4Pq8AfF/tHxZS0Ow3rXL/7z4M4SwWLrMYQgepLmrbq6vd
	PRrYAvqTZIYkwOdwof9Nu4bSEM7jKaydbtToEXpWC/NI53BqWWKhnQG6QPNFs13B2YB/
	vyL7Ikz33PIN51gX8QjFVoHnJ9PF5+uAISbOo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type;
	b=PVb435zxfyZlZ6R0s2kA5XE1DpQrPZoNcurhoD7KM9bj/yU3VOOBsq/Nhxxan4OrzQ
	WXVHGkQxlehSqLkBp4tFwFeCwKZ78YDOFLl57dFGFQut+NL3F1QizJnr1PXaj8hECyUk
	bRfy5a2EaXG4mhEhUpyodZR49wlA43PXvOHZY=
MIME-Version: 1.0
Received: by 10.143.24.15 with SMTP id b15mr1748978wfj.41.1268346054894; Thu,
	11 Mar 2010 14:20:54 -0800 (PST)
In-Reply-To: <4B974995.6070508@obviously.com>
References: <4B974995.6070508@obviously.com>
Date: Thu, 11 Mar 2010 15:20:54 -0700
Message-ID: <6d8daee31003111420t6c658c9i593301f33725565a@mail.gmail.com>
Subject: Re: Remote monitoring of Postgres w/minimal grants
From: Tony Wasson <ajwasson@gmail.com>
To: Bryce Nesbitt <bryce2@obviously.com>
Cc: pgsql-sql@postgresql.org
Content-Type: multipart/alternative; boundary=001636e0ac620de42604818dd4a7
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-2.598 tagged_above=-10 required=5
	tests=BAYES_00=-2.599, HTML_MESSAGE=0.001
X-Spam-Level: 
X-Archive-Number: 201003/63
X-Sequence-Number: 33770

--001636e0ac620de42604818dd4a7
Content-Type: text/plain; charset=ISO-8859-1

On Wed, Mar 10, 2010 at 12:26 AM, Bryce Nesbitt <bryce2@obviously.com>wrote:

> I'm setting up remote monitoring of postgres, but running into an
> uncomfortable situation with permissions.
> Basically it seems hard to set up a secure "read only" role, yet also allow
> proper monitoring.
>
> A brief writeup of that is here:
>
> http://help.logicmonitor.com/installation-getting-started/notes-for-monitoring-specific-types-of-hosts/databases/postgresql/postgresql-credentials/
> In order to get accurate server busy stats and max query time, the
> LogicMonitor user needs to be a superuser "alter role logicmonitor
> superuser;". Without the SuperUser privilege, all servers will appear busy,
> and maximum query time will always be 0.
>
> Is there a way to grant the type of permission needed to view stats,
> without superuser?
>

Seems like you could get around most of these cases by making a function or
set returning function to return the data and making it "security definer"
and then grant your monitoring user access to that.

Tony

--001636e0ac620de42604818dd4a7
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div class=3D"gmail_quote">On Wed, Mar 10, 2010 at 12:26 AM, Bryce Nesbitt =
<span dir=3D"ltr">&lt;<a href=3D"mailto:bryce2@obviously.com">bryce2@obviou=
sly.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D=
"border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padd=
ing-left: 1ex;">
I&#39;m setting up remote monitoring of postgres, but running into an uncom=
fortable situation with permissions.<br>
Basically it seems hard to set up a secure &quot;read only&quot; role, yet =
also allow proper monitoring.<br>
<br>
A brief writeup of that is here:<br>
<a href=3D"http://help.logicmonitor.com/installation-getting-started/notes-=
for-monitoring-specific-types-of-hosts/databases/postgresql/postgresql-cred=
entials/" target=3D"_blank">http://help.logicmonitor.com/installation-getti=
ng-started/notes-for-monitoring-specific-types-of-hosts/databases/postgresq=
l/postgresql-credentials/</a><br>

In order to get accurate server busy stats and max query time, the LogicMon=
itor user needs to be a superuser &quot;alter role logicmonitor superuser;&=
quot;. Without the SuperUser privilege, all servers will appear busy, and m=
aximum query time will always be 0.<br>

<br>
Is there a way to grant the type of permission needed to view stats, withou=
t superuser?<br></blockquote><div><br>Seems like you could get around most =
of these cases by making a function or set returning function to return the=
 data and making it &quot;security definer&quot; and then grant your monito=
ring user access to that.<br>
<br>Tony<br></div></div>

--001636e0ac620de42604818dd4a7--