Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm installing PostgreSQL on RedHat Linux using rpm installers and I'm trying to get the application to be owned and run by a system user other than "postgres", for example "dbuser5". It seems I could change the permissions on the postgres application and database files after the install, but then the /etc/init.d/postgresql script will still have references to the postgres system user. Since there may be other files that reference this default system user, I'm hoping there's some better way to do this.

Preferably, I'd like to configure this during the install, but if I have to do it after the fact, that should work as well.

share|improve this question
    
The application user and database user are independent. There's no reason to use the same account, and it doesn't give you any better security. You can however create roles and permission for your application user from within postgres. –  Yoav Aner Feb 9 '12 at 20:20
    
I realize that it doesn't really matter what application user I use, the only reason I'm looking at changing this is to comply with a policy about system user ids. –  Quinn Bailey Feb 9 '12 at 20:27
    
sounds like a silly policy then :) it definitely seems to cause more harm than good. As correctly pointed out by voretaq7 - you'd have to be careful with upgrades etc. Also, anything that relies on / checks for a postgres user will likely fail –  Yoav Aner Feb 9 '12 at 20:30
    
@YoavAner Quinn seems to be asking about changing the os user that Postgres runs under, not the database roles. (Although by default Postgres creates its first superuser account based on the name of the system user initdb was invoked as -- Thereafter they are independent though, and you can even rename the database superuser if you want) –  voretaq7 Feb 9 '12 at 20:32
    
Thanks @voretaq7. I understood this was the case. I still think it is a little risky to change it and wouldn't achieve much. –  Yoav Aner Feb 9 '12 at 20:33
show 4 more comments

1 Answer

up vote 0 down vote accepted

Stop the database server, change the ownership on the Postgres data directory, update your startup scripts to reference the correct user, and start the database server again.
Document your changes so someone expecting Postgres to be running as a traditional Postgres user account won't be unpleasantly surprised.

If you are using RedHat's packaged Postgres installation (installed from yum/RPMs) you will need to be aware of this change and make sure to check the startup script when you upgrade to ensure it hasn't been overwritten.

share|improve this answer
    
This occurred to me right after I asked the question and it does seem to be working. It still would be nice if I could specify a different user during the install, or run a specific command to change the user, but it wasn't that hard to make those changes manually. –  Quinn Bailey Feb 9 '12 at 20:24
    
The last time I looked at the Redhat packages was many years ago, but they didn't have any way to specify this stuff - it was all hard-coded. You could make your own RPM that takes the postgres system user as an option (or easily-configurable variable at the top of the script). It's really easier to just edit the script though :) –  voretaq7 Feb 9 '12 at 20:27
    
This was quite a bit easier than I was expecting, so your point about upgrades is the only thing that's concerning me now. Maybe I need to raise that as a reason to just keep the default "postgres" user :) –  Quinn Bailey Feb 9 '12 at 20:32
    
Linux package managers are usually good about telling you Hey, this script changed - do you want me to overwrite it with the default one from the package?. That said, like @YoavAner said it's usually better not to change (and thus not to have to worry about this) unless there's a really good reason. –  voretaq7 Feb 9 '12 at 20:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.