I used sudo su postgres and set up my database while logged in as the linux user postgres. After exiting to my normal shell, logged in as my non-root user, I can simply use psql -U postgres and then do whatever I want with any database, Postgres user, etc. Is this normal, and does it pose a security risk?

  • 1
    What does your pg_hba.conf say? – Michael Hampton Dec 15 '12 at 3:41
  • @MichaelHampton - Aha, thanks :) Do you think it's a good practice to modify the all in the local to read postgres instead? – orokusaki Dec 15 '12 at 3:48

Sounds like your pg_hba.conf is set to trust for local connections. If you trust your local users, that's not too bad, though I don't think it's ever a great idea for production.

Make really sure that trust isn't set for host (network) connections - it's sort-of OK to allow trust for but it's something I'd only actually consider doing for a test setup, never for production. You should be using md5 password auth or a strong security mechanism like certificate auth, Kerberos, etc for network clients.

  • Excellent! Thanks, Craig - I'll use md5, since the server is only accessible in a private network. What would you say to my question posed above in the OP comments? – orokusaki Dec 15 '12 at 3:49
  • 1
    @orokusaki It depends on whether or not you trust your local users (and the security of the host system to prevent an illicit login) -- Generally as Craig said I would not do this in production. – voretaq7 Dec 15 '12 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.