Run PostgreSQL without admin / superuser

Question

I'm trying to setup a secure append-only database with PostgreSQL or MySQL. My idea for that is to generate a database where no admin/superuser accounts exists and only users with limited privileges can insert data to the database. The lack of superuser accounts should be no problem as the database will be setup completely from scratch if any admin changes need to be made.

My idea was to generate the database with an admin user (with an encrypted hash) and then immediately delete the admin user (or lock him out by setting the password to blank).

Is that a suitable approach?

Answer 1

This answer is about PostgreSQL.

You cannot drop a superuser unless you are a superuser yourself. Nobody can drop the bootstrap superuser (normally postgres) because he owns the system objects.

Resetting the password won't prevent a user from logging in.

Keep the superuser around and don't allow it to connect.

For that, you could add the following lines at the beginning of pg_hba.conf:

host  all   postgres  0.0.0.0/0  reject
host  all   postgres       ../0  reject
# if you are truly paranoid and want to forbid local connections
local all   postgres             reject

Don't forget to reload PostgreSQL after that.

Answer 2

Both databases offer superuser access to the person who installed them. eg postgresql's single user mode and mysql's –skip-grant-tables

If you want to hide information from the user don't store it on their computer. you could try encrypting it and that will work until they figure out how you have encrypted it.

Given that you've set the owner of the computer up as your adversary you may be able to use the TPM to help you, but that would be off-topic here.