From: | Markus Bräunig <markus(at)braeunig(dot)biz> |
---|---|
To: | Justin Pryzby <pryzby(at)telsasoft(dot)com> |
Cc: | Devrim Gündüz <devrim(at)gunduz(dot)org>, "pgsql-pkg-yum(at)postgresql(dot)org" <pgsql-pkg-yum(at)postgresql(dot)org> |
Subject: | Re: /var/lib/pgsql 0755 |
Date: | 2021-05-27 19:17:21 |
Message-ID: | 463F7267-4169-40AD-9AF9-855EDB696895@braeunig.biz |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-pkg-yum |
Not at all,
we normally just have about 3 users (used) on the servers:
root, postgres and a monitoring user.
We directly login into the postgres user (ssh key | auditing through bastion host if necessary | no password set).
In the past most suid bit binaries were forbidden by policy and on most System this still is the way to go.
Markus
> Am 27.05.2021 um 20:50 schrieb Justin Pryzby <pryzby(at)telsasoft(dot)com>:
>
> On Thu, May 27, 2021 at 06:40:40PM +0000, Markus Bräunig wrote:
>> I thought as long as /v/l/p is the homedir of postgres user we should be carefully with changes like this.
>
> I think you mean that you do things like "sudo -iu postgres" to open an
> interactive shell. Probably because you want to "cd" into the dir and "ls".
>
> I imagine that's common, but is itself strange to me. You can just "ls" the
> dir without sudo without opening an interactive shell, and do anything else,
> too. Which is safer (avoids the risk of then leaving the shell opened or
> running as the wrong user in the wrong window) and avoids starting down the
> path of running around the system putting on different users' "hats".
>
> System users like this are for running their specific daemon, for isolation
> purposes and not for running interactive shells. It shouldn't have a password
> set, either.
>
>> We normally shift the data dir to other places and the log files as well. For the logfiles we use a separate group combined with a sgid bit
>
> --
> Justin
From | Date | Subject | |
---|---|---|---|
Next Message | Christoph Berg | 2021-05-27 20:28:57 | Re: /var/lib/pgsql 0755 |
Previous Message | Justin Pryzby | 2021-05-27 18:50:25 | Re: /var/lib/pgsql 0755 |