Re: [External] How to revoke privileged from PostgreSQL's superuser - Mailing list pgsql-admin

From Vijaykumar Jain
Subject Re: [External] How to revoke privileged from PostgreSQL's superuser
Date
Msg-id 932A7324-FC28-4F5F-8CD2-C772B5B891C0@opentable.com
Whole thread Raw
In response to How to revoke privileged from PostgreSQL's superuser  (bejita0409@yahoo.co.jp)
List pgsql-admin

I am not sure superuser can be selectively restricted via queries, but I am not sure, have not tried.

 

But maybe you can try restricting the super user access to the db from all hosts via the pg_hba.conf.

 

Fore eg. I have a user

monitor            | Superuser

 

and

in my /etc/postgresql/10/main/pg_hba.conf

 

host pgtesting monitor 0.0.0.0/0       reject

 

and then

psql -U monitor -p 5432 -d pgtesting -h 127.0.0.1

psql: FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL on

FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL off

 

psql -U monitor -p 5432 -d pgtesting -h localhost

psql: FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL on

FATAL:  pg_hba.conf rejects connection for host "127.0.0.1", user "monitor", database "pgtesting", SSL off

 

psql -U monitor -p 5432 -d pgtesting -h 173.16.6.3

psql: FATAL:  pg_hba.conf rejects connection for host "173.16.6.3", user "monitor", database "pgtesting", SSL on

FATAL:  pg_hba.conf rejects connection for host "173.16.6.3", user "monitor", database "pgtesting", SSL off

 

 

https://stackoverflow.com/questions/38942868/revoke-superuser-connect-a-specific-database

 

Thanks,

Vijay

 

 

From: "bejita0409@yahoo.co.jp" <bejita0409@yahoo.co.jp>
Reply-To: "bejita0409@yahoo.co.jp" <bejita0409@yahoo.co.jp>
Date: Monday, August 6, 2018 at 3:19 PM
To: "pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>, "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: [External] How to revoke privileged from PostgreSQL's superuser

 

 

I am a newbie DBA.

 

I have a request for revoking the access to user's data from DBA-user.

I think the request is right because users should be the only ones can access their data.

But DBA-user also need full access to the other data? It means that DBA-user also needs to be a superuser.

 

So I conclude the request that how to revoke privileged from superuser in postgres.

 

As my knowledge, the superuser in PostgreSQL bypasses all the permission check.

So that, there is no way to do it in PostgreSQL, is that right?

 

Is there some DBAs are faced with this before?

 

 

Thanks,

--

bejita

pgsql-admin by date:

Previous
From: bejita0409@yahoo.co.jp
Date:
Subject: How to revoke privileged from PostgreSQL's superuser
Next
From: "Jehan-Guillaume (ioguix) de Rorthais"
Date:
Subject: Re: PostgreSQL 11 global index