I have a doubt about superusers and single-user mode.

I want to restrict the access to a certain database, in a way that only those users which I gave privileges can see the structure of my database. To achieve that, I had to erase the superuser, since it bypasses all permission checks. But then I found that if I have access to the computer, I can enter in "single-user mode" and grant superuser privileges or even creating new users.

My question

Can I disallow permanently the use of superusers and single-user mode?

  • 1
    Why do people have access to the server? Why do non DBAs have the superuser's passeord? – Michael Kutz Jul 11 '19 at 20:28

You will find that you need superuser access for certain tasks, e.g. CREATE EXTENSION.

Vieving database metadata is not a security problem. Just because you know that there is a column with credit card data doesn't get you any closer to accessing it.

There is no way to keep somebody with shell access as PostgreSQL OS user from doing anything they want. Whoever can read the data files has access to all information.

Rather than spending effort on breaking PostgreSQL, invest in proper security:

  • Restrict shell access to the database machine.

  • Don't allow remote superuser access.

  • Encrypt connections.

  • Use an external, centralized authentication provider.

  • Grant object permissions as restrictive as possible.

  • Thank you very much for your answer and advise. It has really clarify my doubt. – Duskel Jul 12 '19 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.