Re: Disallow access from psql, or allow access only from specific client app

Στις Monday 25 July 2011 16:08:53 ο/η Sim Zacks έγραψε:
> A lot of applications don't actually have a database role per user.
>
> There is an application user who logs into the database and the
> application handles application logins through a users table in the
> database. That way the only thing that the user has access to is the
> application and not the database.
>

That was the dominating fashion for some 10+ years, but if you think of it,
it is totally pathetic to have broken the link from the actual user to the underlying
DB.
We have reverted the whole security setup to using distinct user credentials/user, which are delegated
by the application (jboss). So the user logs in once, and gets access with the same credential to both
the app server and the DB.
Now we can see exactly who is in, what is he doing, etc... what app is he/she running, etc...

> If you access the database through an application server, or server side
> script, you can limit access to only that (and other specific) IP
> addresses in the pg_hba.conf.

I would support the same thing. Just enable only localhost access, prevent users from loging in this machine
(by not .... making them any accounts) and you are done.

This password hacking thing, has some problems, 1st it relies on security via obscurity,
and second, it needs the authentication to be done programmatically from user code.
What if the connections are in pools managed by pool managers?
How easy would it be to hack the passwords/userids this way?

>
>
> Sim
>
>
> On 07/25/2011 02:56 PM, Mario Puntin wrote:
>
> > Thanks a lot to everybody for the replies.
> >
> > Kurt: by the term "client" I meant an application, like psql, from
> > which users could connect to the database, as they have a
> > user/password, and manipulate data. I want them to access from
> > certain, specific application, but I don't want them to install psql,
> > for example, and have also access through it.
> >
> > I liked Chris Carver idea of modifing user/password: quite simple and
> > efective.
> > But thank you all people, you gave me some fine ideas.
> >
> > Best regards,
> > Mario
> >
>
>

--
Achilleas Mantzios