sudo su postgres and set up my database while logged in as the linux user
postgres. After exiting to my normal shell, logged in as my non-root user, I can simply use
psql -U postgres and then do whatever I want with any database, Postgres user, etc. Is this normal, and does it pose a security risk?
Sounds like your
pg_hba.conf is set to
local connections. If you trust your local users, that's not too bad, though I don't think it's ever a great idea for production.
Make really sure that
trust isn't set for
host (network) connections - it's sort-of OK to allow
trust for 127.0.0.1 but it's something I'd only actually consider doing for a test setup, never for production. You should be using
md5 password auth or a strong security mechanism like certificate auth, Kerberos, etc for network clients.