0

I'm trying to setup a secure append-only database with PostgreSQL or MySQL. My idea for that is to generate a database where no admin/superuser accounts exists and only users with limited privileges can insert data to the database. The lack of superuser accounts should be no problem as the database will be setup completely from scratch if any admin changes need to be made.

My idea was to generate the database with an admin user (with an encrypted hash) and then immediately delete the admin user (or lock him out by setting the password to blank).

Is that a suitable approach?

Improve this question

2 Answers 2

Reset to default
1

This answer is about PostgreSQL.

You cannot drop a superuser unless you are a superuser yourself. Nobody can drop the bootstrap superuser (normally postgres) because he owns the system objects.

Resetting the password won't prevent a user from logging in.

Keep the superuser around and don't allow it to connect.

For that, you could add the following lines at the beginning of pg_hba.conf:

host  all   postgres  0.0.0.0/0  reject
host  all   postgres       ../0  reject
# if you are truly paranoid and want to forbid local connections
local all   postgres             reject

Don't forget to reload PostgreSQL after that.

Improve this answer
2
  • Thanks for the answer, but if the database runs on a machine locally, what prevents the hacker from just changing the pg_hba.conf file? The method could be easily changed to TRUST again, couldn't it?
    – Niklay
    May 29, 2019 at 14:45
  • 2
    There is no way to keep an attacker with shell access as PostgreSQL OS user from breaking into the database. Don't even try. It will take an expert 5 minutes. What you should do is secure the database from remote attacks.
    – Laurenz Albe
    May 29, 2019 at 16:32
0

Both databases offer superuser access to the person who installed them. eg postgresql's single user mode and mysql's –skip-grant-tables

If you want to hide information from the user don't store it on their computer. you could try encrypting it and that will work until they figure out how you have encrypted it.

Given that you've set the owner of the computer up as your adversary you may be able to use the TPM to help you, but that would be off-topic here.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.