Few days ago I wanted to configure a postgresql server so that users connecting to their database would not be able to see other databases. Among other things, I wanted to restrict the usage of :

psql -l database user

This command will retrieve the list of database on the server, even if the user has no access right to them. If you issue this command, you'll et something like :

                   List of databases
              Name               |  Owner   | Encoding  
---------------------------------+----------+-----------
 database_1                      | postgres | UTF8
 database_2                      | user_foo | UTF8
 ...

The solution

Well at least one solution : in each database, the special virtual table pg_database (see here for the documentation) contains the list of all the databases hosted on the server. So if we remove access rights on this table, users won't be able to list the databases anymore.

But wait, this table is available in every databases. So we need to remove these access rights on all databases. So far so good.

Oh but what if a user creates a new database ? Yes, this new database will have this pg_database table, with default access rights, which allow anybody to list its content, thus getting the list of existing databases on the server.

So what we need is to change the access rights of the pg_database on newly crated databases. How do we do that ? by connecting to the special database template1 (see here for the documentation). This database contains the default content (and their associated rights) that are used to populate newly created databases. So in addition to changing the access rights of pg_database on every databases, we'll need to do the same on template1.

Now how do we change the access right? What we want is deny users the right to get the database list. That is, extracting the database list from pg_database. That is, select'ing the data of this table. So we simply need to revoke the select permission on the table, for everybody. We do that with this command :

revoke select on pg_database from public;

Execute this query on all the databases of your server, plus on the special template1 database. Then, trying to list the databases will return :

psql -l database user
ERROR:  permission denied for relation pg_database

Instead of a long post explaining why I think it's great and what I use it for, I'm going to write some blog entries that each describe one important use case.

But generally speaking, the main reasons I bought an iPhone are :

• I already have a macbook Pro, and the iPhone is the easiest way to synchronize to it, carry my important stuff in my pocket.
• iPhone is really the internet in you pocket. I didn't believe the great advertizing, but yes it is true, internet is always with me. And Because it has numerous users, quite a lot of websites are iPhone oriented.
• Using my public linux server, my Mac and the iPhone, I can create some scripts, bridges and other things to have everything deeply interconnected. Alarms, events, IM, etc... More about that in a later post.
• The AppStore is full of Applications, and some of them are really useful for system administration on the go.

So I'm happy to celebrate my comeback with the much awaited ebuild for the new version of booh : 0.9.1.

This new version (well actually 0.9.0) brings a lot of new features and programs : album2booh booh-classifier booh-fix-whitebalance booh-gamma-correction webalbum2booh

Enjoy!