What are the consequences of dropping or changing the user name for the postgres DB account?

Question

I feel confident I understand what's involved at the db level:

• If dropping, I'd need to create users for each sys admin, give them SUPERUSER, and then drop the postgres user.
• If changing the name, I'd need to alter the postgres account.

My problem, though, is that I'm not sure what the consequences of this action would be. For example, what would it mean from the point of view of the Linux postgres user? When I su - postgres, I can run psql and I'm able to connect to the database. I assume that capability goes away if the postgres DB user is gone.

Also, the database is started using the postgres linux user. Is there some issue if I remove the postgres user that would make it so the database wouldn't even be able to start?

From ps:

/usr/pgsql-9.3/bin/postgres -D /var/lib/pgsql/9.3/data PG_GRANDPARENT_PID=1 USER=postgres PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin PWD=/ PGLOCALEDIR=/usr/pgsql-9.3/share/locale LANG=en_US.UTF-8 PGSYSCONFDIR=/etc/sysconfig/pgsql SHLVL=1 HOME=/var/lib/pgsql LOGNAME=postgres PGDATA=/var/lib/pgsql/9.3/data _=/usr/pgsql-9.3/bin/postgres

I'm running PosrgreSQL 9.3 on Cent OS 7.

Answer 1

The Linux postgres user is entirely different from the postgres database user. It's created via the rpm package. When you're logged in as the system postgres user, it assumes the database user and database name that you're wanting to connect to is the same as the operating system user that you're attempting to connect from. That's why a simple psql works, and logs you into the database as the postgres user and database.

The postgres database is just a copy of template1. You can delete it or recreate it with few problems. You won't be able to drop the postgres user, however, because it's required by the database system.

user1@[local]:5432:user1:=# DROP ROLE postgres;
ERROR:  cannot drop role postgres because it is required by the database system
Time: 50.570 ms
user1@[local]:5432:user1:=#

However, you can block the login of the user by setting all the connections that you use to reject for the postgres, which will keep users from using that particular user for login, instead of their assigned users.