3

I'm installing PostgreSQL on RedHat Linux using rpm installers and I'm trying to get the application to be owned and run by a system user other than "postgres", for example "dbuser5". It seems I could change the permissions on the postgres application and database files after the install, but then the /etc/init.d/postgresql script will still have references to the postgres system user. Since there may be other files that reference this default system user, I'm hoping there's some better way to do this.

Preferably, I'd like to configure this during the install, but if I have to do it after the fact, that should work as well.

8
  • The application user and database user are independent. There's no reason to use the same account, and it doesn't give you any better security. You can however create roles and permission for your application user from within postgres.
    – Yoav Aner
    Feb 9, 2012 at 20:20
  • I realize that it doesn't really matter what application user I use, the only reason I'm looking at changing this is to comply with a policy about system user ids. Feb 9, 2012 at 20:27
  • sounds like a silly policy then :) it definitely seems to cause more harm than good. As correctly pointed out by voretaq7 - you'd have to be careful with upgrades etc. Also, anything that relies on / checks for a postgres user will likely fail
    – Yoav Aner
    Feb 9, 2012 at 20:30
  • @YoavAner Quinn seems to be asking about changing the os user that Postgres runs under, not the database roles. (Although by default Postgres creates its first superuser account based on the name of the system user initdb was invoked as -- Thereafter they are independent though, and you can even rename the database superuser if you want)
    – voretaq7
    Feb 9, 2012 at 20:32
  • Thanks @voretaq7. I understood this was the case. I still think it is a little risky to change it and wouldn't achieve much.
    – Yoav Aner
    Feb 9, 2012 at 20:33

2 Answers 2

1

Stop the database server, change the ownership on the Postgres data directory, update your startup scripts to reference the correct user, and start the database server again.
Document your changes so someone expecting Postgres to be running as a traditional Postgres user account won't be unpleasantly surprised.

If you are using RedHat's packaged Postgres installation (installed from yum/RPMs) you will need to be aware of this change and make sure to check the startup script when you upgrade to ensure it hasn't been overwritten.

4
  • This occurred to me right after I asked the question and it does seem to be working. It still would be nice if I could specify a different user during the install, or run a specific command to change the user, but it wasn't that hard to make those changes manually. Feb 9, 2012 at 20:24
  • The last time I looked at the Redhat packages was many years ago, but they didn't have any way to specify this stuff - it was all hard-coded. You could make your own RPM that takes the postgres system user as an option (or easily-configurable variable at the top of the script). It's really easier to just edit the script though :)
    – voretaq7
    Feb 9, 2012 at 20:27
  • This was quite a bit easier than I was expecting, so your point about upgrades is the only thing that's concerning me now. Maybe I need to raise that as a reason to just keep the default "postgres" user :) Feb 9, 2012 at 20:32
  • Linux package managers are usually good about telling you Hey, this script changed - do you want me to overwrite it with the default one from the package?. That said, like @YoavAner said it's usually better not to change (and thus not to have to worry about this) unless there's a really good reason.
    – voretaq7
    Feb 9, 2012 at 20:44
0

I'm about to test this approach, but it looks like the PostgreSQL pg_ident.conf file could be used to map the required OS username to the default database username installed by the RPM, e.g. postgres.

https://www.postgresql.org/docs/current/auth-username-maps.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .