0

I'm trying to setup a secure append-only database with PostgreSQL or MySQL. My idea for that is to generate a database where no admin/superuser accounts exists and only users with limited privileges can insert data to the database. The lack of superuser accounts should be no problem as the database will be setup completely from scratch if any admin changes need to be made.

My idea was to generate the database with an admin user (with an encrypted hash) and then immediately delete the admin user (or lock him out by setting the password to blank).

Is that a suitable approach?

0

This answer is about PostgreSQL.

You cannot drop a superuser unless you are a superuser yourself. Nobody can drop the bootstrap superuser (normally postgres) because he owns the system objects.

Resetting the password won't prevent a user from logging in.

Keep the superuser around and don't allow it to connect.

For that, you could add the following lines at the beginning of pg_hba.conf:

host  all   postgres  0.0.0.0/0  reject
host  all   postgres       ../0  reject
# if you are truly paranoid and want to forbid local connections
local all   postgres             reject

Don't forget to reload PostgreSQL after that.

  • Thanks for the answer, but if the database runs on a machine locally, what prevents the hacker from just changing the pg_hba.conf file? The method could be easily changed to TRUST again, couldn't it? – Niklas May 29 at 14:45
  • There is no way to keep an attacker with shell access as PostgreSQL OS user from breaking into the database. Don't even try. It will take an expert 5 minutes. What you should do is secure the database from remote attacks. – Laurenz Albe May 29 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.