Few days ago I wanted to configure a postgresql server so that users connecting to their database would not be able to see other databases. Among other things, I wanted to restrict the usage of :

psql -l database user

This command will retrieve the list of database on the server, even if the user has no access right to them. If you issue this command, you'll et something like :

                   List of databases
              Name               |  Owner   | Encoding  
---------------------------------+----------+-----------
 database_1                      | postgres | UTF8
 database_2                      | user_foo | UTF8
 ...

The solution

Well at least one solution : in each database, the special virtual table pg_database (see here for the documentation) contains the list of all the databases hosted on the server. So if we remove access rights on this table, users won't be able to list the databases anymore.

But wait, this table is available in every databases. So we need to remove these access rights on all databases. So far so good.

Oh but what if a user creates a new database ? Yes, this new database will have this pg_database table, with default access rights, which allow anybody to list its content, thus getting the list of existing databases on the server.

So what we need is to change the access rights of the pg_database on newly crated databases. How do we do that ? by connecting to the special database template1 (see here for the documentation). This database contains the default content (and their associated rights) that are used to populate newly created databases. So in addition to changing the access rights of pg_database on every databases, we'll need to do the same on template1.

Now how do we change the access right? What we want is deny users the right to get the database list. That is, extracting the database list from pg_database. That is, select'ing the data of this table. So we simply need to revoke the select permission on the table, for everybody. We do that with this command :

revoke select on pg_database from public;

Execute this query on all the databases of your server, plus on the special template1 database. Then, trying to list the databases will return :

psql -l database user
ERROR:  permission denied for relation pg_database

• Redirect every http:// URLs to https://
• Except if it's the atom or RSS URL
• Redirect the https://.*atom.xml or rss URL to http://

And I failed. I couldn't make a pattern that says : "that doesn't end with atom.xml" or similar...

So I ended up with a compromise : only redirect /cgi-bin/mt URLs to https://. It works but I'm not quite satisfied. I'll give it another try later

So I'm happy to celebrate my comeback with the much awaited ebuild for the new version of booh : 0.9.1.

This new version (well actually 0.9.0) brings a lot of new features and programs : album2booh booh-classifier booh-fix-whitebalance booh-gamma-correction webalbum2booh

Enjoy!

The newest addition on this server :

• squid to act as proxy
• backup-manager as a backup solution

backup-manager is not very powerful, but it's small, light and simple to install and configure. All you need is Perl and gettext :) It'll do until I migrate to bacula.

So now I use different keys for work and home, and ssh keychain on both.

Next move is to add my work identity to my home session to be able to connect directly to servers at work without having to go through my workstation at work. Without putting my home private id on my machine at work, nor copying my home public id on all servers at work. It should be possible I've heard :)

Anyway, here is briefly how I did it : ssh-keygen (dsa as main key). Then install keychain (see http://www.gentoo.org/proj/en/keychain/ and configure it a bit. I added the following script in /etc/profile.d/keychain.sh (gentoo host), and I use the built in keychain on my mac.

#!/bin/bash
# start keychain, with the private keys to be cached
/usr/bin/keychain ~/.ssh/id_dsa
# then load the generated files
for i in ~/.keychain/*-sh*; do
echo "sourcing $i"
source $i
done

I know, I know, everybody is supposed to know everything about ssh, but I'm happy to admit that I learnt 2 or 3 things while setting up everything properly. Besides, how many of you have no passphrase on your ssh key ? :)

If you are running a PadLock enabled Via CPU, this page has a list of patches for various linux programs. Look at the bottom of the page for contributions, and see if you're using any of these software. Even if you are using the same version, I recommend you to check if the patch hasn't been already applied by the maintainers of your linux distribution.

I applied the patchs for openssh, lighthttpd and a couple of other software.