You are correct and I agree with you. The sudo option would work best with
individuals who do not have much Linux SA experience to know or figure
out these options.
I agree with the original premises posted by several that limiting the
number of people with root access is the best option. But was trying to
provide another option. I am not sure why so many people need root access
simply to adjust a table. If trusted, they should be able to do that using
their own account. I guess you could scour the history files of everyone
(short time step) and archive that data if needed to provide an activity
BUT...Robin was completely correct when stating:
"Any attempt to create an audit trail by adding in username capture in
the software is doomed to being circumvented by anybody with root access
who doesn't want to be traced."
Scott - I think the above is also the point you are also trying to
make...and again I agree.
Short of removing everyone with root access and developing software that
forces the user to input username and password to change table
entries...there may not be much that can be done. If you don't trust people
with root password, don't give it to them.
On Wed, Mar 14, 2012 at 11:46 AM, Scott Ribe <scott_ribe(at)elevated-dev(dot)com>wrote:
> On Mar 14, 2012, at 9:28 AM, David Ondrejik wrote:
> > So there is some trail to track back to the original user.
> Yes, but once he has root shell, the trail ends there, and impersonation
> of anyone is once again trivial. Also, sudo su root, does work on some
> unices, and the option you don't want to advertise is, in my opinion,
> trivially obvious--but I'll respect the idea and not advertise it.
> Scott Ribe
> (303) 722-0567 voice
Dave Ondrejik - Senior Hydrologist
National Weather Service
Middle Atlantic River Forecast Center
328 Innovation Blvd, Suite #330
State College, PA 16870
See us on the web at:
In response to
pgsql-admin by date
|Next:||From: Kris Deugau||Date: 2012-03-14 16:24:45|
|Subject: Re: Update actions (with user name) inside PostgreSQL DB
- any version on postgreSQL|
|Previous:||From: Scott Ribe||Date: 2012-03-14 15:46:42|
|Subject: Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL|