服务器之家

服务器之家 > 正文

postgresql限制某个用户仅连接某一个数据库的操作

时间:2021-03-07 18:30     来源/作者:lk_db

创建数据库bbb且owner为用户b:

?
1
2
3
postgres9.6@[local]:5432 postgres# create database bbb owner b;
CREATE DATABASE
Time: 259.099 ms

默认情况下使用用户c也可以连接数据库bbb:

?
1
2
postgres9.6@[local]:5432 postgres# \c bbb c
You are now connected to database "bbb" as user "c".

回收public的connect on database bbb权限:

?
1
2
3
4
5
c@[local]:5432 bbb# \c postgres postgres9.6
You are now connected to database "postgres" as user "postgres9.6".
postgres9.6@[local]:5432 postgres# revoke connect on database bbb from public;
REVOKE
Time: 2.088 ms

此时用户c没有了连接数据库bbb的权限:

?
1
2
3
4
postgres9.6@[local]:5432 postgres# \c bbb c
FATAL: permission denied for database "bbb"
DETAIL: User does not have CONNECT privilege.
Previous connection kept

但bbb数据库的owner用户b可以连接数据库:

?
1
2
3
postgres9.6@[local]:5432 postgres# \c bbb b
You are now connected to database "bbb" as user "b".
b@[local]:5432 bbb#

此种情况下超级用户也可以连接该数据库:

?
1
2
3
4
5
6
7
8
9
10
11
b@[local]:5432 bbb# \c bbb postgres9.6
You are now connected to database "bbb" as user "postgres9.6".
postgres9.6@[local]:5432 bbb#
postgres9.6@[local]:5432 bbb# \du
                  List of roles
 Role name |             Attributes             | Member of
-------------+------------------------------------------------------------+-----------
 a      |                              | {}
 b      |                              | {}
 c      |                              | {}
 postgres9.6 | Superuser, Create role, Create DB, Replication, Bypass RLS | {}

另外一种方法:从pg_hba.conf中限定:

?
1
2
3
4
5
6
7
8
# TYPE DATABASE    USER      ADDRESS         METHOD
# "local" is for Unix domain socket connections only
local  all       all                  trust
# IPv4 local connections:
host  all       all       127.0.0.1/32      trust
...
#
host  all  all        0.0.0.0/0       md5

补充:Postgres限制每个用户只能连接指定数量的session,防止服务器资源紧张

限制每个用户只能连接指定数量的session,防止服务器资源紧张

(1)创建测试用户test:

?
1
2
3
4
5
6
7
8
highgo=#create user test;
CREATEROLE
highgo=#\du
               List of roles
 Role name |          Attributes          | Member of
-----------+------------------------------------------------+----------
 highgo  | Superuser, Create role, Create DB, Replication | {}
 test   |                        | {}

(2)设置仅允许用户test使用一个连接

?
1
2
highgo=#ALTER ROLE test CONNECTION LIMIT 1;
ALTERROLE

(3)在session 1中使用test用户连接highgo数据库

?
1
2
3
highgo=>\c highgo test
Youare now connected to database "highgo" as user "test".
highgo=>

(4)在session 2中也使用test用户连接highgo数据库,会出现如下错误:

?
1
2
3
highgo=#\c highgo test
致命错误: 由角色"test"发起的连接太多了
Previousconnection kept

(5)查询用户test链接限制

?
1
2
3
4
5
highgo=>SELECT rolconnlimit FROM pg_roles WHERE rolname = 'test';
 rolconnlimit
--------------
      1
(1row)

以上为个人经验,希望能给大家一个参考,也希望大家多多支持服务器之家。如有错误或未考虑完全的地方,望不吝赐教。

原文链接:https://blog.csdn.net/lk_db/article/details/88952602

相关文章

热门资讯

2020微信伤感网名听哭了 让对方看到心疼的伤感网名大全
2020微信伤感网名听哭了 让对方看到心疼的伤感网名大全 2019-12-26
yue是什么意思 网络流行语yue了是什么梗
yue是什么意思 网络流行语yue了是什么梗 2020-10-11
Intellij idea2020永久破解,亲测可用!!!
Intellij idea2020永久破解,亲测可用!!! 2020-07-29
背刺什么意思 网络词语背刺是什么梗
背刺什么意思 网络词语背刺是什么梗 2020-05-22
苹果12mini价格表官网报价 iPhone12mini全版本价格汇总
苹果12mini价格表官网报价 iPhone12mini全版本价格汇总 2020-11-13
返回顶部