Re: [GENERAL] How to have a blind-superuser

2006-04-25 Thread Geoffrey
Tom Lane wrote: If you don't trust your DBA, You should fire him/her... -- Until later, Geoffrey Any society that would give up a little liberty to gain a little security will deserve neither and lose both. - Benjamin Franklin ---(end of broadcast)--

Re: [GENERAL] How to have a blind-superuser

2006-04-25 Thread Geoffrey
Steve Atkins wrote: So... you're not going to be able to do this _at_all_ from within the database. You're going to need an external solution, probably a hideous seteuid thing, if you really want to do this. And it's a really bad idea, so you probably don't want to. Thinking out loud on this o

Re: [GENERAL] How to have a blind-superuser

2006-04-24 Thread Christopher Browne
After a long battle with technology, "Qingqing Zhou" <[EMAIL PROTECTED]>, an earthling, wrote: > ""Jim C. Nasby"" <[EMAIL PROTECTED]> wrote >> On Mon, Apr 24, 2006 at 06:16:30PM +0800, Qingqing Zhou wrote: >> > Is it possible to have a superuser who could do CHECKPOINT, BACKUP and >> > whatever bu

Re: [GENERAL] How to have a blind-superuser

2006-04-24 Thread Orion
Qingqing Zhou wrote: >Basically I wonder if I can have a superuer that he has every priviliges as >he does now (create language, rotate log files, create checkpoint and >everything superuser can do) but one thing I want to make sure is that he >could not see any user data for security reason (just

Re: [GENERAL] How to have a blind-superuser

2006-04-24 Thread Steve Atkins
On Apr 24, 2006, at 6:31 PM, Qingqing Zhou wrote: ""Jim C. Nasby"" <[EMAIL PROTECTED]> wrote On Mon, Apr 24, 2006 at 06:16:30PM +0800, Qingqing Zhou wrote: Is it possible to have a superuser who could do CHECKPOINT, BACKUP and whatever but could not see any user data? Not for backup. It'

Re: [GENERAL] How to have a blind-superuser

2006-04-24 Thread Jim C. Nasby
On Tue, Apr 25, 2006 at 09:31:48AM +0800, Qingqing Zhou wrote: > > ""Jim C. Nasby"" <[EMAIL PROTECTED]> wrote > > On Mon, Apr 24, 2006 at 06:16:30PM +0800, Qingqing Zhou wrote: > > > Is it possible to have a superuser who could do CHECKPOINT, BACKUP and > > > whatever but could not see any user da

Re: [GENERAL] How to have a blind-superuser

2006-04-24 Thread Tom Lane
"Qingqing Zhou" <[EMAIL PROTECTED]> writes: > Basically I wonder if I can have a superuer that he has every priviliges as > he does now (create language, rotate log files, create checkpoint and > everything superuser can do) but one thing I want to make sure is that he > could not see any user data

Re: [GENERAL] How to have a blind-superuser

2006-04-24 Thread Qingqing Zhou
""Jim C. Nasby"" <[EMAIL PROTECTED]> wrote > On Mon, Apr 24, 2006 at 06:16:30PM +0800, Qingqing Zhou wrote: > > Is it possible to have a superuser who could do CHECKPOINT, BACKUP and > > whatever but could not see any user data? > > Not for backup. It'd be rather tricky to allow backing up data wi

Re: [GENERAL] How to have a blind-superuser

2006-04-24 Thread Jim C. Nasby
On Mon, Apr 24, 2006 at 06:16:30PM +0800, Qingqing Zhou wrote: > Is it possible to have a superuser who could do CHECKPOINT, BACKUP and > whatever but could not see any user data? Not for backup. It'd be rather tricky to allow backing up data without being able to read it, afterall. I believe CHE