0

I've just set up Postgres for use by different users on my network. Every user has his own username/password/database, but when I connect to Pg I can also see a 'postgres' database (and even create tables etc). I tried to REVOKE access to that database from public but then it won't let me connect. What exactly is the postgres database and why is it needed? Can I disable it so that users only see the database(s) I've created for them?

2 Answers 2

3

The postgres database is created by default when you run initdb.

Quote from the manual:

Creating a database cluster consists of creating the directories in which the database data will live (...) creating the template1 and postgres databases. When you later create a new database, everything in the template1 database is copied. (...) The postgres database is a default database meant for use by users, utilities and third party applications.

There is nothing special about it, and if you don't need it, you can drop it:

drop database postgres;

You need to do that as a superuser of course. The only downside of this is that when you run psql as the postgres operating system user, you need to explicitly provide a database name to connect to

1

If you drop the postgres database you'll find a few things to be confusing. Most tools default to using it as the default database to connect to, for one thing. Also, anything run under the postgres user will by default expect to connect to the postgres database.

Rather than dropping it, REVOKE the default connect right to it.

REVOKE connect ON DATABASE postgres FROM public;

The superuser (usually postgres), and any users you explicitly grant rights to access the database can still use it as a convenience DB to connect to. But others can't.

To grant connect rights to a user, simply:

GRANT connect ON DATABASE postgres TO myuser;
4
  • Revoking connect on the the 'postgres' database prevents my users from connecting to their 'regular' databases, e.g. they get "Error connecting to the server: FATAL: permission denied for database "postgres" DETAIL: User does not have CONNECT privilege." Granting those rights to a user allows them to view and edit the database, which is a bit weird considering this is a "system" database and only the superuser is supposed to have access to it (at least in terms of writing/modifying).
    – yha
    Feb 3, 2015 at 7:59
  • Also, the fact that this is a publicly accessible and writable database means users can "spam" the database with data (up to a very large size) and/or overwrite things other users have written. It's not a big deal really but it is an annoyance and I'd like to know what the best practices are as far as dealing with this special database.
    – yha
    Feb 3, 2015 at 8:33
  • @user3609832 Re preventing connection to other DBs... No, it shouldn't. You can verify this with psql. Maybe they are using a tool that assumes this db is present? If they are using pgadmin they must override the default system database. Feb 3, 2015 at 21:29
  • @user3609832 The "best practices" are to revoke access to it as stated. Or you could revoke create on schema public and instead if you insist on having the postgres db accessible. I strongly suggest you do some reading on multi-tenant hosting schemes for PostgreSQL. Feb 3, 2015 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.