John Morton <jwm@plain.co.nz> writes:
>> webclient <---> proxy <---> Postgres
> Minuses:
> - Another machine to buy
> - Root on the proxy is as bad as root was on the secure server, so..
> - The simple hack will need thorough security auditing
> - It's yet another machine to secure.
> - It's yet another point of failure.
What?? Who said anything about another machine? I was just
thinking another daemon process on the database server machine.
> What I'm really asking is is there any way of doing this with just
> triggers or rules, and if not, can a function be written to examine the
> where clause (or whatever it's called in the parse tree) and select
> triggers be hacked into the database?
No. If there were, what makes you think that it'd be easier to
security-audit it than a standalone proxy?
regards, tom lane
