Run PostgreSQL without admin / superuser

Question

I'm trying to setup a secure append-only database with PostgreSQL or MySQL. My idea for that is to generate a database where no admin/superuser accounts exists and only users with limited privileges can insert data to the database. The lack of superuser accounts should be no problem as the database will be setup completely from scratch if any admin changes need to be made.

My idea was to generate the database with an admin user (with an encrypted hash) and then immediately delete the admin user (or lock him out by setting the password to blank).

Is that a suitable approach?

Answer 1

This answer is about PostgreSQL.

You cannot drop a superuser unless you are a superuser yourself. Nobody can drop the bootstrap superuser (normally postgres) because he owns the system objects.

Resetting the password won't prevent a user from logging in.

Keep the superuser around and don't allow it to connect.

For that, you could add the following lines at the beginning of pg_hba.conf:

host all postgres 0.0.0.0/0 reject
host all postgres ../0 reject
# if you are truly paranoid and want to forbid local connections
local all postgres reject

Don't forget to reload PostgreSQL after that.

• Niklay: Thanks for the answer, but if the database runs on a machine locally, what prevents the hacker from just changing the pg_hba.conf file? The method could be easily changed to TRUST again, couldn't it?
• Laurenz Albe: There is no way to keep an attacker with shell access as PostgreSQL OS user from breaking into the database. Don't even try. It will take an expert 5 minutes. What you should do is secure the database from remote attacks.

Answer 2

Both databases offer superuser access to the person who installed them. eg postgresql's single user mode and mysql's –skip-grant-tables

If you want to hide information from the user don't store it on their computer. you could try encrypting it and that will work until they figure out how you have encrypted it.

Given that you've set the owner of the computer up as your adversary you may be able to use the TPM to help you, but that would be off-topic here.