2011-02-13

The Back Door to Postgres

When you install Postgres 9 on your Mac, the installer automatically creates a user named "postgres" and prompts you to invent a password for that user. The goal is security, so that if your main user account is compromised, your database's contents may remain safely within folders controlled by that other 'postgres' user.

Normally we never need access to the actual files that make up the database. We have command line access via the 'psql' tool. We have GUI admin apps such as the bundled 'pgAdmin', and from countless 3rd-party vendors. We have the 'pgDump' and 'pgRestore' tools to backup and restore the database's contents. Because of all those tools, you may never need to actually pierce the veil to peer at the actual disk files that make up the database.

But just in case you ever do have such a need, or curiosity gets the better of you, you can use the Terminal.app this way:
sudo su postgres
Type that into Terminal, hit return, and use your regular Mac admin account password as prompted. The word 'postgres' is the name of the special user created by the Postgres installer. Be very careful – you will be working with all the "safeties" turned off, enabling you to take actions that are normally forbidden to protect you from yourself.

To leave that session, type:
exit
Posted by at

1 comment:

  1. loquinMonday, 12 September, 2011

    You have it backwards - the separate user account, postgres, created by the installer, is actually intended to protect your computer from hacking if someone hacks the database; even IF a hacker were to gain low-level access to the system via postgres, they would NOT have admin access to the computer - they would only the limited postgres access. Yes, they could trash the data (but surely you keep a backup!) but they wouldn't have root access to trash the whole system.

    ReplyDelete

Subscribe to: Post Comments (Atom)