I'm running a PostgreSQL database server, version 10 on Linux, for multiple users. Today I found out by surprise that any user can see all other users' databases and their tables, columns and other properties, but not the data. I'm wondering why this is the case? Shouldn't a user be restricted to their own databases? Why is this access granted at all and how can I remove it?
The users were created with this command:
The databases were created with this command:
createdb -O "user1" "user1_db1"
I've read something about the CONNECT privilege in the Postgres documentation but I couldn't find out how to list all the privleges that a user currently has. An article suggests revoking all privileges and granting CONNECT only on the user's database. I don't want to do that before I know what other privileges the user possibly has. Also, is this required for each new database created for the user? The documentation doesn't seem to cover this topic at all.