PostgreSQL Security

PostgreSQL security combines authentication, authorization, network boundaries, encrypted communication, data protection, and operational process. Pigsty provides configuration entry points for these mechanisms; operators must still harden, verify, and audit the deployment for its environment.

Concepts and Boundaries

Configuration Reference

• HBA Configuration: declare PostgreSQL and PgBouncer authentication rules.
• Access Control Configuration: configure default roles, application users, object privileges, and database ACLs.
• User Configuration: define user attributes, role membership, and connection-pool options.
• CRIT Parameter Template: critical parameters for synchronous replication, checksums, logging, and watchdog.

Administration and Verification

• User Management: create, update, and remove users.
• HBA Management: refresh rules, inspect effective configuration, and troubleshoot authentication.
• Security Considerations: production hardening and acceptance checklist.
• Security Recommendations: minimum password, network, and file checks before installation.

The inventory describes desired state. Acceptance checks should also inspect HBA, certificates, listen ports, and sensitive files on running nodes, and verify effective roles and privileges through PostgreSQL catalogs.