>
>
> Q Beukes wrote:
>
>>Hello,
>>
>>Is there not some other alternative to pg_hba.conf?
>>
>>I have the problem where the system administrators at our company
>>obviously have access to the whole filesystem, and our database records
>>needs to be hidden even from them.
>>
>>With pg_hba.conf that is not possible, as they just change all the conf
>>lines to "trust" auth and viola they have access to the database without
>>passwords.
>>
>>Is there a more secure alternative to this? The perfect scenario being
>>to deny everyone include "root" access to a database without a password.
>>
>>
>>
>>
>
> This is an illusion, as plenty of security experts will tell you.
> Password auth is a losing game for high security in the first place. So
> this comment shows that you haven't thought this out properly.
>
> If you want the data hidden from system administrators, you need to have
> the client encrypt it before storing it. Of course, that will have
> massive implications for your application.
And even then, your admins will probably have access to the application
source and, if they want, can get data.
The unpopular reality is that if you must keep something secret, you can't
give access to it to anyone who is not trusted to keep the secret. The
best bet is to have one system that has the "secret" data, managed by
those who are trusted.
It means that the "trusted" people are on the hook for backups and
preventive maintenence, but secrets aren't free.
