PostgreSQL Security

PostgreSQL security combines authentication, authorization, network boundaries, encrypted communication, data protection, and operating procedures. Pigsty provides configuration parameters for these mechanisms. Operators must still harden, verify, and audit the deployment for its environment.

Concepts and Boundaries

Configuration Reference

• HBA Configuration: declare PostgreSQL and PgBouncer authentication rules.
• Access Control Configuration: configure default roles, application users, object privileges, and database ACLs.
• User Configuration: define user attributes, role membership, and connection-pool options.
• CRIT Parameter Template: critical parameters for synchronous replication, checksums, logging, and watchdog.

Administration and Verification

• User Management: create, update, and remove users.
• HBA Management: refresh rules, inspect effective configuration, and troubleshoot authentication.
• Security Considerations: production hardening and acceptance checklist.
• Security Recommendations: minimum password, network, and file checks before installation.

The inventory describes the required state. Acceptance checks should inspect HBA, certificates, listening ports, and sensitive files on running nodes. They should also verify effective roles and privileges through PostgreSQL catalogs.