From 9b8aff8c192e2f313f90395d114c58a9ef84f97f Mon Sep 17 00:00:00 2001 From: Magnus Hagander Date: Wed, 29 Dec 2010 11:05:03 +0100 Subject: Add REPLICATION privilege for ROLEs This privilege is required to do Streaming Replication, instead of superuser, making it possible to set up a SR slave that doesn't have write permissions on the master. Superuser privileges do NOT override this check, so in order to use the default superuser account for replication it must be explicitly granted the REPLICATION permissions. This is backwards incompatible change, in the interest of higher default security. --- doc/src/sgml/catalogs.sgml | 11 +++++++++++ doc/src/sgml/func.sgml | 4 ++-- doc/src/sgml/high-availability.sgml | 27 ++++++++++++++++++++------- doc/src/sgml/ref/alter_role.sgml | 5 ++++- doc/src/sgml/ref/alter_user.sgml | 1 + doc/src/sgml/ref/create_role.sgml | 16 ++++++++++++++++ doc/src/sgml/ref/create_user.sgml | 1 + 7 files changed, 55 insertions(+), 10 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml index ef35fd9767e..9fa20cfeee9 100644 --- a/doc/src/sgml/catalogs.sgml +++ b/doc/src/sgml/catalogs.sgml @@ -1235,6 +1235,17 @@ + + rolreplication + bool + + Role is a replication role. That is, this role can initiate streaming + replication (see ) and set/unset + the system backup mode using pg_start_backup and + pg_stop_backup. + + + rolconnlimit int4 diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml index 6005acc2340..d1777759e65 100644 --- a/doc/src/sgml/func.sgml +++ b/doc/src/sgml/func.sgml @@ -13969,14 +13969,14 @@ SELECT set_config('log_statement_stats', 'off', false); pg_start_backup(label text , fast boolean ) text - Prepare for performing on-line backup (restricted to superusers) + Prepare for performing on-line backup (restricted to superusers or replication roles) pg_stop_backup() text - Finish performing on-line backup (restricted to superusers) + Finish performing on-line backup (restricted to superusers or replication roles) diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml index bbcc6b68220..46a97e19ce3 100644 --- a/doc/src/sgml/high-availability.sgml +++ b/doc/src/sgml/high-availability.sgml @@ -636,8 +636,8 @@ protocol to make nodes agree on a serializable transactional order. If you want to use streaming replication, set up authentication on the primary server to allow replication connections from the standby - server(s); that is, provide a suitable entry or entries in - pg_hba.conf with the database field set to + server(s); that is, create a role and provide a suitable entry or + entries in pg_hba.conf with the database field set to replication. Also ensure max_wal_senders is set to a sufficiently large value in the configuration file of the primary server. @@ -796,15 +796,28 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r' It is very important that the access privileges for replication be set up so that only trusted users can read the WAL stream, because it is easy to extract privileged information from it. Standby servers must - authenticate to the primary as a superuser account. - So a role with the SUPERUSER and LOGIN - privileges needs to be created on the primary. + authenticate to the primary as an account that has the + REPLICATION privilege. So a role with the + REPLICATION and LOGIN privileges needs to be + created on the primary. + + + + It is recommended that a dedicated user account is used for replication. + While it is possible to add the REPLICATION privilege to + a superuser account for the purporses of replication, this is not + recommended. While REPLICATION privilege gives very high + permissions, it does not allow the user to modify any data on the + primary system, which the SUPERUSER privilege does. + + + Client authentication for replication is controlled by a pg_hba.conf record specifying replication in the database field. For example, if the standby is running on - host IP 192.168.1.100 and the superuser's name for replication + host IP 192.168.1.100 and the account name for replication is foo, the administrator can add the following line to the pg_hba.conf file on the primary: @@ -823,7 +836,7 @@ host replication foo 192.168.1.100/32 md5 standby (specify replication in the database field). For example, if the primary is running on host IP 192.168.1.50, - port 5432, the superuser's name for replication is + port 5432, the account name for replication is foo, and the password is foopass, the administrator can add the following line to the recovery.conf file on the standby: diff --git a/doc/src/sgml/ref/alter_role.sgml b/doc/src/sgml/ref/alter_role.sgml index 8c832d56d6b..adc0273b835 100644 --- a/doc/src/sgml/ref/alter_role.sgml +++ b/doc/src/sgml/ref/alter_role.sgml @@ -31,6 +31,7 @@ ALTER ROLE name [ [ WITH ] connlimit | [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password' | VALID UNTIL 'timestamp' @@ -63,7 +64,7 @@ ALTER ROLE name [ IN DATABASE CREATEROLE privilege can change any of these - settings, but only for non-superuser roles. + settings, but only for non-superuser and non-replication roles. Ordinary roles can only change their own password. @@ -127,6 +128,8 @@ ALTER ROLE name [ IN DATABASE NOINHERIT LOGIN NOLOGIN + REPLICATION + NOREPLICATION CONNECTION LIMIT connlimit PASSWORD password ENCRYPTED diff --git a/doc/src/sgml/ref/alter_user.sgml b/doc/src/sgml/ref/alter_user.sgml index d332c8ea140..7588f636ed2 100644 --- a/doc/src/sgml/ref/alter_user.sgml +++ b/doc/src/sgml/ref/alter_user.sgml @@ -31,6 +31,7 @@ ALTER USER name [ [ WITH ] connlimit | [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password' | VALID UNTIL 'timestamp' diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgml index 05f93bf9a3c..a4472629e45 100644 --- a/doc/src/sgml/ref/create_role.sgml +++ b/doc/src/sgml/ref/create_role.sgml @@ -31,6 +31,7 @@ CREATE ROLE name [ [ WITH ] connlimit | [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password' | VALID UNTIL 'timestamp' @@ -174,6 +175,21 @@ CREATE ROLE name [ [ WITH ] + + REPLICATION + NOREPLICATION + + + These clauses determine whether a role is allowed to initiate + streaming replication or put the system in and out of backup mode. + A role having the REPLICATION attribute is a very + highly privileged role, and should only be used on roles actually + used for replication. If not specified, + NOREPLICATION is the default. + + + + CONNECTION LIMIT connlimit diff --git a/doc/src/sgml/ref/create_user.sgml b/doc/src/sgml/ref/create_user.sgml index 2356794cd43..3ef2be17676 100644 --- a/doc/src/sgml/ref/create_user.sgml +++ b/doc/src/sgml/ref/create_user.sgml @@ -31,6 +31,7 @@ CREATE USER name [ [ WITH ] connlimit | [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password' | VALID UNTIL 'timestamp' -- cgit v1.2.3