Re: PostgreSQL security concerns - Mailing list pgsql-general

From Ken Causey
Subject Re: PostgreSQL security concerns
Date
Msg-id 3.0.1.32.20010531103344.0168f98c@pop3.premiernet.net
Whole thread Raw
In response to PostgreSQL security concerns  (Ken Causey <ken@ineffable.com>)
Responses Re: PostgreSQL security concerns  (Peter Eisentraut <peter_e@gmx.net>)
Re: PostgreSQL security concerns  (Francesco Casadei <f_casadei@libero.it>)
List pgsql-general
OK, I am aware of this file.  I need to provide a little more detail.

The situation is that of a shared webserver and a shared SQL server.
Access to the SQL server is limited to the webserver already.  Users can
only run CGI scripts which will of course execute as the webserver user.
What I'm looking for is restricting access by postgresql user.  All logins
will be coming from the same host and same host user.  I don't
see this capability as part of pg_hba.conf.  Did I miss it?

Ken Causey

At 07:41 AM 5/31/01 -0700, you wrote:
>RTFM re: pg_hba.conf.
>

<snip some good stuff>

>Ian A. Harding
>Programmer/Analyst II
>Tacoma-Pierce County Health Department
>(253) 798-3549
>mailto: ianh@tpchd.org
>
>>>> Ken Causey <ken@ineffable.com> 05/31/01 07:34AM >>>
>I've been using PostgreSQL in a limited environment for a couple of years
>now.  I'm in a position where I will soon need to be able to allow
>multi-user access.  I'm concerned that, as far as I can tell, any user can
>access any database with impunity.  Is this correct?  Have I missed some
>configuration?
>
>Ken Causey
>
>P.S. I'm not currently on this list, so please reply to me directly.
>


pgsql-general by date:

Previous
From: Ken Causey
Date:
Subject: PostgreSQL security concerns
Next
From: Andrew Sullivan
Date:
Subject: Getting trigger names on a table