On 7/21/22 12:46, Tom Lane wrote:
"David G. Johnston" <david.g.johns...@gmail.com> writes:
On Thu, Jul 21, 2022 at 9:28 AM Tom Lane <t...@sss.pgh.pa.us> wrote:
True, but what if the idea is to have *no* superusers? I seem
to recall people being interested in setups like that.
I would expect an initdb option (once this is possible) to specify this
desire and we just never set one up in the first place. It seems
impractical to remove one after it already exists.
There has to be a role that owns the built-in objects. Robert's point
is that pretending that that role isn't high-privilege is silly.
My strategy has been to ensure no other roles are members of the
bootstrap superuser role, and then alter the bootstrap user to be
NOLOGIN. E.g. in the example here:
https://github.com/pgaudit/set_user/blob/1335cd34ca91b6bd19d5e910cc93c831d1ed0db0/README.md?plain=1#L589
And checked here:
https://github.com/pgaudit/set_user/blob/1335cd34ca91b6bd19d5e910cc93c831d1ed0db0/README.md?plain=1#L612
https://github.com/pgaudit/set_user/blob/1335cd34ca91b6bd19d5e910cc93c831d1ed0db0/README.md?plain=1#L618
--
Joe Conway
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
