User administration tool

I have started coding a user/group administration tool that allows you
to add/modify/delete users and groups. I should have something working
in a week. I will look similar to my pgmonitor tool.

semi related to this, I have always thought that the way postgresql
handles the deletion of users and groups to be flawed. If I create a user,
grant permissions on a table and then drop the user, permissions now exist
on that table for a user that does not exist. I see this as a possible
security flaw since a new user can then be created with the user id of the
ID user and have all the permissions that might have ever been assigned to
that old user. When a user is deleted, shouldn't all permissions associated
with that user be deleted also, I would think this could be handled with a
PK/ FK cascading delete type setup.

my 2�

Matt O'Connor

Bruce Momjian writes:

I have started coding a user/group administration tool that allows you
to add/modify/delete users and groups. I should have something working
in a week. I will look similar to my pgmonitor tool.

Pgaccess already does part of this. If you're going to write it in Tcl/Tk
anyway, I think you might as well integrate it there.

--
Peter Eisentraut peter_e@gmx.net http://yi.org/peter-e/

Matthew writes:

semi related to this, I have always thought that the way postgresql
handles the deletion of users and groups to be flawed. If I create a user,
grant permissions on a table and then drop the user, permissions now exist
on that table for a user that does not exist.

Unfortunately it is not possible to prevent this with anything approaching
ease, in the same way that userdel on Unix can't scan all file systems for
some to-be-stale files before removing users.

I see this as a possible security flaw since a new user can then be
created with the user id of the ID user and have all the permissions
that might have ever been assigned to that old user.

This will be fixed in 7.2 when Oids will be used as user ids. Of course
Oids can wrap, but that's another days project...

--
Peter Eisentraut peter_e@gmx.net http://yi.org/peter-e/

Bruce Momjian writes:

I have started coding a user/group administration tool that allows you
to add/modify/delete users and groups. I should have something working
in a week. I will look similar to my pgmonitor tool.

Pgaccess already does part of this. If you're going to write it in Tcl/Tk
anyway, I think you might as well integrate it there.

Wow, I see. I never suspected it did that too. :-) Seems I don't need
to write anything, except perhaps add group capabilities to pgaccess.

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026

On Fri, Mar 30, 2001 at 10:48:54AM -0500, Bruce Momjian wrote:

Bruce Momjian writes:

I have started coding a user/group administration tool that allows you
to add/modify/delete users and groups. I should have something working
in a week. I will look similar to my pgmonitor tool.

Pgaccess already does part of this. If you're going to write it in Tcl/Tk
anyway, I think you might as well integrate it there.

Wow, I see. I never suspected it did that too. :-) Seems I don't need
to write anything, except perhaps add group capabilities to pgaccess.

Isn't phpPgAdmin yet another tool of this type? I haven't tried it myself,
(no need, myself being the only user...) but the web page
(http://www.greatbridge.org/project/phppgadmin/projdisplay.php) says:

Features include:

* create and drop databases
* create, copy, drop and alter
tables/views/sequences/functions/indicies/triggers
* edit and add fields (to the extent Postgres allows)
* execute any SQL-statement, even batch-queries
* manage primary and unique keys
* create and read dumps of tables
* administer one single database
* administer multiple servers
* administer postgres users and groups

Greetinx, Jan
-- 
 +- Jan T. Kim -------------------------------------------------------+
 |  *NEW* -->  email: kim@inb.mu-luebeck.de                           |
 |  *NEW* -->  WWW:   http://www.inb.mu-luebeck.de/staff/kim.html     |
 *-----=<  hierarchical systems are for files, not for humans  >=-----*

Wow, I see. I never suspected it did that too. :-) Seems I don't need
to write anything, except perhaps add group capabilities to pgaccess.

Isn't phpPgAdmin yet another tool of this type? I haven't tried it myself,
(no need, myself being the only user...) but the web page
(http://www.greatbridge.org/project/phppgadmin/projdisplay.php) says:

Yes, it is. Some people prefer a non-web interaface.

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026

<moved to -interfaces, where it belongs ... >

On Fri, 30 Mar 2001, Bruce Momjian wrote:

Wow, I see. I never suspected it did that too. :-) Seems I don't need
to write anything, except perhaps add group capabilities to pgaccess.

Isn't phpPgAdmin yet another tool of this type? I haven't tried it myself,
(no need, myself being the only user...) but the web page
(http://www.greatbridge.org/project/phppgadmin/projdisplay.php) says:

Yes, it is. Some people prefer a non-web interaface.

I could understand this sentiment if you were doing something from the
command line, but if you are doing an interface in tcl/tk, I think a web
interface fairs better ...

tcl/tk, you have to be on the same machine or risk "network problems"
losing your link ... web, its a stateless connection, so each time you do
something, it re-establishes the connection and performs the operation ...

IMHO, a web interface will always be appropriate in a network environment,
unless you have the luxury of sitting on the same machine you are running
the X app (tcl/tk) on ... *shrug*

The Hermit Hacker writes:

Yes, it is. Some people prefer a non-web interaface.

I could understand this sentiment if you were doing something from the
command line, but if you are doing an interface in tcl/tk, I think a web
interface fairs better ...

tcl/tk, you have to be on the same machine or risk "network problems"
losing your link ...

A Tcl/Tk applications doesn't risk any more network problems than any
other interface to the database, unless that interface is run on the same
machine as the database, which is by no means a given.

If you are under a constant risk of "network problems" then you better fix
your network. A web interface won't magically bridge network problems.

web, its a stateless connection, so each time you do something, it
re-establishes the connection and performs the operation ...

It makes the whole thing slower and won't let you preserve state. This
seems to be a disadvantage to me.

--
Peter Eisentraut peter_e@gmx.net http://yi.org/peter-e/

On Fri, 30 Mar 2001, Peter Eisentraut wrote:

The Hermit Hacker writes:

Yes, it is. Some people prefer a non-web interaface.

I could understand this sentiment if you were doing something from the
command line, but if you are doing an interface in tcl/tk, I think a web
interface fairs better ...

tcl/tk, you have to be on the same machine or risk "network problems"
losing your link ...

A Tcl/Tk applications doesn't risk any more network problems than any
other interface to the database, unless that interface is run on the same
machine as the database, which is by no means a given.

If you are under a constant risk of "network problems" then you better fix
your network. A web interface won't magically bridge network problems.

my "network problem" happens to be a database server half way across the
country from me ... running a tcl/tk interface would be useless, while a
web interface does exactly what I need ...