Обсуждение: Preventing database access (including valid users in other databases)
I would like to prevent users including users who may be valid in other databases from accessing a particular database, I have excluded database username associations of their usernames with the database in the hba.conf file, but I observed that they can still connect to the database, query metadata (by use of \d) but cannot perform queries. Is there a way to fully prevent database connect and query of metadata? Interesting scenario, I have a user who owns database objects (tables, sequences) in a database, now I have decided not to allow the user by connect to the database by excluding the user's username from the database username association in the hba.conf, I restarted the server. However the user can still connect to the database, and the user can query the objects they own but cannot query objects they do not own in that database. Is this the expected behaviour and should I explicitly change ownership of the objects. Allan. __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com
On Mon, 2005-09-26 at 06:09, Allan Kamau wrote: > Interesting scenario, I have a user who owns database > objects (tables, sequences) in a database, now I have > decided not to allow the user by connect to the > database by excluding the user's username from the > database username association in the hba.conf, I > restarted the server. However the user can still > connect to the database, and the user can query the > objects they own but cannot query objects they do not > own in that database. Is this the expected behaviour Personally I think you've misconfigured your pg_hba.conf. If you'd like to send it along with your db version you might be able to get a more definitive answer. > and should I explicitly change ownership of the > objects. > Well, it doesn't make much sense to me to have a bunch of objects in a database owned by someone who will never be allowed to connect to that database. Robert Treat -- Build A Brighter Lamp :: Linux Apache {middleware} PostgreSQL