Few days ago I wanted to configure a postgresql server so that users connecting to their database would not be able to see other databases. Among other things, I wanted to restrict the usage of :

psql -l database user

This command will retrieve the list of database on the server, even if the user has no access right to them. If you issue this command, you'll et something like :

                   List of databases
              Name               |  Owner   | Encoding  
---------------------------------+----------+-----------
 database_1                      | postgres | UTF8
 database_2                      | user_foo | UTF8
 ...

The solution

Well at least one solution : in each database, the special virtual table pg_database (see here for the documentation) contains the list of all the databases hosted on the server. So if we remove access rights on this table, users won't be able to list the databases anymore.

But wait, this table is available in every databases. So we need to remove these access rights on all databases. So far so good.

Oh but what if a user creates a new database ? Yes, this new database will have this pg_database table, with default access rights, which allow anybody to list its content, thus getting the list of existing databases on the server.

So what we need is to change the access rights of the pg_database on newly crated databases. How do we do that ? by connecting to the special database template1 (see here for the documentation). This database contains the default content (and their associated rights) that are used to populate newly created databases. So in addition to changing the access rights of pg_database on every databases, we'll need to do the same on template1.

Now how do we change the access right? What we want is deny users the right to get the database list. That is, extracting the database list from pg_database. That is, select'ing the data of this table. So we simply need to revoke the select permission on the table, for everybody. We do that with this command :

revoke select on pg_database from public;

Execute this query on all the databases of your server, plus on the special template1 database. Then, trying to list the databases will return :

psql -l database user
ERROR:  permission denied for relation pg_database

Instead of a long post explaining why I think it's great and what I use it for, I'm going to write some blog entries that each describe one important use case.

But generally speaking, the main reasons I bought an iPhone are :

• I already have a macbook Pro, and the iPhone is the easiest way to synchronize to it, carry my important stuff in my pocket.
• iPhone is really the internet in you pocket. I didn't believe the great advertizing, but yes it is true, internet is always with me. And Because it has numerous users, quite a lot of websites are iPhone oriented.
• Using my public linux server, my Mac and the iPhone, I can create some scripts, bridges and other things to have everything deeply interconnected. Alarms, events, IM, etc... More about that in a later post.
• The AppStore is full of Applications, and some of them are really useful for system administration on the go.

The pictures here : Paris.pm 07/08/08 [flickr]

That was part of the preparation for our upcoming trip in Chamonix (mainly rock climbing, and maybe a bit of easy ice climbing). That was the first time I ever did ice climbing, and it is really great Ice climbing is all about holding yourself to an ice wall that could break at any moment, with very very sharp tools in your hands and on your feet. Falling is basically not an option. I think the first rule of ice climbing is humility.

As part of the trip preparation, I also got new shoes and crampons, as pictured. These scarpa shoes are really nice. They are considered as the "classic" shoes for summer mountaineering. My last shoes were very old, bulky and pretty "old school". These new shoes are lighter, smarter, and hurt less. Plus they have an incredible style :)

I'm sure all of you Mac users know that, but I just found that out and I'm really happy about it :)

I have just released a new build of Claws Mail for Mac OS X Leopard (10.5). Despite the fact that this release is to be considered beta, I'm quite excited about it. Why?

Up to now, the builds required an X11 server to be installed (usually Apple's X11.App ). Indeed, Claws Mail is a Gtk+ software, originally built for Linux. And until recently, running Gtk+ on Mac OS X required to compile and link against X11.

However, a project finally achieved to port Gtk+ to Mac OS X natively. I'm talking about Imendio's project .

Although I had played with this Gtk+ port in the past (the default demo application ran quite well), I waited for the Port to be a bit more mature.

When I decided to try to build Claws Mail on top of this native Gtk+ port, it took me only one night to do it. The Gtk+ port compiled flawlessly, all I got to do is resolve the usual Mac / Claws compilation issues, as well as the packaging.

So anyway, I'm proud to present the first native Mac OS X version of Claws Mail, available as a nice dmg image here .

Beware, although it works quite well (I'm using it currently), this is to be considere beta. Some bugs and glitches will be addressed soon.

Enjoy.

However I had good reasons, and when you'll see the next version that I'm currently trying to build, you'll see why...

So stay tuned !

I found a nice and easy howto describing how to enable RSS feed per category in Movable Type version 4.x.
Here it is

This blog entry describes how to create a new template (RSS category), map it to the categories, and change the main category widget to link to it. I did the similar steps to create an atom feed for each categories.

So now you can see a small feed icon near each category name, on the main page of my blog index page.

So I'm happy to celebrate my comeback with the much awaited ebuild for the new version of booh : 0.9.1.

This new version (well actually 0.9.0) brings a lot of new features and programs : album2booh booh-classifier booh-fix-whitebalance booh-gamma-correction webalbum2booh

Enjoy!

The newest addition on this server :

• squid to act as proxy
• backup-manager as a backup solution

backup-manager is not very powerful, but it's small, light and simple to install and configure. All you need is Perl and gettext :) It'll do until I migrate to bacula.

So now I use different keys for work and home, and ssh keychain on both.

Next move is to add my work identity to my home session to be able to connect directly to servers at work without having to go through my workstation at work. Without putting my home private id on my machine at work, nor copying my home public id on all servers at work. It should be possible I've heard :)

Anyway, here is briefly how I did it : ssh-keygen (dsa as main key). Then install keychain (see http://www.gentoo.org/proj/en/keychain/ and configure it a bit. I added the following script in /etc/profile.d/keychain.sh (gentoo host), and I use the built in keychain on my mac.

#!/bin/bash
# start keychain, with the private keys to be cached
/usr/bin/keychain ~/.ssh/id_dsa
# then load the generated files
for i in ~/.keychain/*-sh*; do
echo "sourcing $i"
source $i
done

I know, I know, everybody is supposed to know everything about ssh, but I'm happy to admit that I learnt 2 or 3 things while setting up everything properly. Besides, how many of you have no passphrase on your ssh key ? :)

Today I just wanted to briefly mention A To G, a small free mac application that simply exports all the adress book data to a csv files that gmail can import.

The features are nice and it looks great, plus the statically generated content means it's fast to deliver. But it's quite a pain to add and edit all the pages through the web interface. I'm quite new to Movable Type, so it might be that I just missed the powerful editor.

Anyway I kind of like it as a whole, but I ca't wait to use advanced features that made me choose MT in the first place : blogging from an iphone, installing new plugins, and editing my templates.

• DragThing : not free, but really an awesome piece of software, get it here. It allows you to create panes and panels from diffrent shapes, style and content. screenshot here. The icons on the left aren't on the desktop, they are in a transparent panel in the foreground.

• Switcheroo : minimalistic, does less things, but can be useful. Get it from versiontracker