Re: security issues - Mailing list pgsql-admin

From David G. Johnston
Subject Re: security issues
Date
Msg-id CAKFQuwaHx7YzHxYoH9VX=fpTc73xCX09C5m1EVp7GRffT65jKw@mail.gmail.com
Whole thread Raw
In response to security issues  (Frank Eckes <frank.eckes@online.de>)
List pgsql-admin
On Friday, December 10, 2021, Frank Eckes <frank.eckes@online.de> wrote:

Is there e possibility that I can hide the definition and th user can only see the data or can execute

the procedure/function.

No.  This comes up every so often so the archives are a good place to find a more lengthy discussion.


And even worse, if i define a foreign server (e.g ORACLE) everybody can see the credentials in a user mapping

which should not be allowed. This might be a show stopper of using PostgreSQL in security environments.


This one is a bit more nuanced and I’m not as familiar with the specifics.  For a PostgreSQL server I would setting up pg_hba.conf to allow a non-password connection from the specific machine and user so that password credentials are simply not required.

David J.

pgsql-admin by date:

Previous
From: Laurenz Albe
Date:
Subject: Re: security issues
Next
From: Tom Lane
Date:
Subject: Re: security issues