HiveBrain v1.2.0
Get Started
← Back to all entries
patternsqlMinor

Postgres Server access restricted to only one database from list of databases

Submitted by: @import:stackexchange-dba··
0
Viewed 0 times
databasespostgresdatabaseoneserverlistfromrestrictedonlyaccess

Problem

I am trying on the server side to restrict a user connecting on LAN to seeing and accessing only 1 database from the list of databases I have in my system.

How can I achieve this?

I have tried

host    db_name     all       (connecting_ip)/32          krb5

host    db_name     all       (connecting_ip)/32          ident

host    db_name     all       (connecting_ip)/32          crypt

host    db_name     all       (connecting_ip)/32          trust


These parameters have been changed in the pg_hba.conf file, and even after that, it still does not work.

Please help with a solution on how to fix this issue so that any user accessing a database in a server with a list of databases can see and access only the required database.

Solution

If you make changes to pg_hba.conf, you need to reload PostgreSQL.

But I think you'd be better off revoking the CONNECT privilege for that user. (Or possibly revoking ALL privileges.) Skeleton syntax is

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }
    ON DATABASE database_name [, ...]
    FROM { [ GROUP ] role_name | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]


Something like

REVOKE CONNECT ON DATABASE database-name FROM fishy_user;


In PostgreSQL, each role (user or group) can be granted permission to access different databases if that's what you want to do. See Database Roles

Code Snippets

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }
    ON DATABASE database_name [, ...]
    FROM { [ GROUP ] role_name | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]
REVOKE CONNECT ON DATABASE database-name FROM fishy_user;

Context

StackExchange Database Administrators Q#7637, answer score: 5

Revisions (0)

No revisions yet.