As a refugee from the big bad O, I am looking at Postgres.
Four security questions (sorry if they have been asked and answered
before):

Can I remove postgres (the user) from pg_hba?
Can I lock the unix postgres account; i.e. set its login shell to /sbin/
nologin?
Can I drop the postgres database?
Can I drop the schemata "public"?

If there is a FAQ, please could someone point to it.

Thanks.

HoneyMonster <someone (AT) someplace (DOT) invalid> wrote:
Yes.


Yes.


Yes. It might cause trouble with command-line tools like 'createuser',
but if it does you could use SQL instead.


Yes.


There's a FAQ at http://wiki.postgresql.org/wiki/FAQ , though it
doesn't seem to mention any of the above.

-M-

On Tue, 07 Dec 2010 21:46:59 +0000, Matthew Woodcraft wrote:

On Tue, 07 Dec 2010 20:49:26 +0000, HoneyMonster wrote:

My advice would be to set the password to '****', character '*' cannot
be generated by Unix hashing function. That means that the only way to
log in would be doing "su - postgres" as root. You don't really want to
close that option.



--
http://mgogala.byethost5.com

On Fri, 10 Dec 2010 04:08:59 +0000, Mladen Gogala wrote:

Yes, thanks. I've applied the three other 'hardening' options in my small
test cluster, but I found that the postmaster wouldn't start at boot if
the postgres unix account was disabled, as the init script contains
'su' (actually 'runuser' for SELinux).

I think I'll adopt your suggestion.

On Tue, 07 Dec 2010 20:49:26 +0000, HoneyMonster wrote:

Don't do that. Postgres is not there yet. For the the porting projects,
you need optimizer hints. There is a fatwa against optimizer hints in the
Postgres community. Case closed. Postgres distrusts its users deeply and
is unwilling to provide them with the tools to control the optimizer,
available with all other major databases. You're either supposed to get a
programming guru to write a custom patch or to go with a commercial
version which, incidentally, has hints.
If you don't want to start the development from scratch, Postgres is not
an option for the Oracle users. I wasted a year until I have realized
that.



--
http://mgogala.byethost5.com