On 2022-11-17 11:36:15 -0800, Bryn Llewellyn wrote:The detail below leads to a simply stated question: Given that the bootstrap superuser must exist, is there ever a reason to create another role with "superuser"? My intuition tells me that the answer is a resounding "No!".Is there ever a reason? Yes. Does that reason apply to you? I don't know. Maybe, maybe not.— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — I wondered, at first, if it might be a good practice to create a second superuser, say "super" with "login", to alter the bootstrap superuser with "nologin", and then to use "super" on an "ordinary" daily basis for tasks that might need this. The thought was that this practice might protect the artifacts that the bootstrap superuser owns from damage. But this thought dissolved into thin air, before it was fully formed, on the realization that the unstoppable "super" could anyway do arbitrary damage to the bootstrap superuser's artifacts.You could create additional superusers and restrict those to certain databases and/or IP ranges. That probably won't stop an attacker (I can think of at least one way to get around that and it's probably even easier than I think) but it might prevent accidental damage.The implication is clear: you should allow a cluster to have just a single superuser, the inevitable bootstrap superuser, and you should think very carefully indeed before ever starting a session as this role because of the risks that doing so brings. Rather, you should realize that there are hardly any tasks that cannot be carried out by an appropriately configured role with "nosuperuser".One important task that can AFAIK only be performed by superusers is the creation of functions in untrusted languages like plpython3u and plperlu. If your application uses functions in those languages you need a superuser to install or upgrade it. hp
Yes, there is such a reason. On several servers that I have to
work with, the user "postgres" is not a log-in user. In other
words, I can't log in as "postgres", I can only log in as my own
user and su to the user "postgres". All users must be
authenticated by the LDAP system and the user "postgres" is not in
the LDAP. Since I am lazy, I granted superuser privilege to my own
user so that I don't have to switch to the user "postgres" every
time I want to do something that affects everybody, like using
"ALTER SYSTEM". I am also a member of the "dba" group on the
Oracle servers, so that I can do "sqlplus / as sysdba" without
switching to the user "oracle". It's the same thing. If I was to
respond by a single word, the word would be "convenience". Or
maybe "covfefe"?
-- Mladen Gogala Database Consultant Tel: (347) 321-1217 https://dbwhisperer.wordpress.com
