Re: Update actions (with user name) inside PostgreSQL DB - any version on postgreSQL

Scott,

You are correct and I agree with you. The sudo option would work best with
individuals who do not have much Linux SA experience to know or figure
out these options.

I agree with the original premises posted by several that limiting the
number of people with root access is the best option. But was trying to
provide another option. I am not sure why so many people need root access
simply to adjust a table. If trusted, they should be able to do that using
their own account. I guess you could scour the history files of everyone
(short time step) and archive that data if needed to provide an activity
trail???

BUT...Robin was completely correct when stating:

"Any attempt to create an audit trail by adding in username capture in
the software is doomed to being circumvented by anybody with root access
who doesn't want to be traced."

Scott - I think the above is also the point you are also trying to
make...and again I agree.
Short of removing everyone with root access and developing software that
forces the user to input username and password to change table
entries...there may not be much that can be done. If you don't trust people
with root password, don't give it to them.

Dave
On Wed, Mar 14, 2012 at 11:46 AM, Scott Ribe <scott_ribe(at)elevated-dev(dot)com>wrote:

> On Mar 14, 2012, at 9:28 AM, David Ondrejik wrote:
>
> > So there is some trail to track back to the original user.
>
> Yes, but once he has root shell, the trail ends there, and impersonation
> of anyone is once again trivial. Also, sudo su root, does work on some
> unices, and the option you don't want to advertise is, in my opinion,
> trivially obvious--but I'll respect the idea and not advertise it.
>
> --
> Scott Ribe
> scott_ribe(at)elevated-dev(dot)com
> http://www.elevated-dev.com/
> (303) 722-0567 voice
>
>
>
>
>

--
Dave Ondrejik - Senior Hydrologist
National Weather Service
Middle Atlantic River Forecast Center
328 Innovation Blvd, Suite #330
State College, PA 16870
(814) 231-2403
david(dot)ondrejik(at)noaa(dot)gov

See us on the web at:
http://www.weather.gov/marfc