database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-10-22 14:32:25 +03:00
Code Activity

Doc: Outline REPLICATION before SUPERUSER privilege

Browse Source 
The following docs are updated:
- High-availaility section
- pg_basebackup
- pg_receivewal

Per the principle of least privilege, we want to encourage users to
interact with those areas using roles that have replication rights, but
superusers were mentioned first.

Author: Daniel Gustafsson
Reviewed-by: Fujii Masao, Michael Paquier
Discussion: https://postgr.es/m/ECEBD212-7101-41EB-84F3-2F356E4B6401@yesql.se
This commit is contained in:
Michael Paquier
2020-05-05 14:16:01 +09:00
parent 849ac35813
commit c5114e42fa
3 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
doc/src/sgml/high-availability.sgml
View File

@@ -827,12 +827,14 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r'
It is very important that the access privileges for replication be set up
so that only trusted users can read the WAL stream, because it is
easy to extract privileged information from it. Standby servers must
authenticate to the primary as a superuser or an account that has the
<literal>REPLICATION</literal> privilege. It is recommended to create a
dedicated user account with <literal>REPLICATION</literal> and <literal>LOGIN</literal>
privileges for replication. While <literal>REPLICATION</literal> privilege gives
very high permissions, it does not allow the user to modify any data on
the primary system, which the <literal>SUPERUSER</literal> privilege does.
authenticate to the primary as an account that has the
<literal>REPLICATION</literal> privilege or a superuser. It is
recommended to create a dedicated user account with
<literal>REPLICATION</literal> and <literal>LOGIN</literal>
privileges for replication. While <literal>REPLICATION</literal>
privilege gives very high permissions, it does not allow the user to
modify any data on the primary system, which the
<literal>SUPERUSER</literal> privilege does.
</para>
<para>