3.3. Creating PostgreSQL users
You can create PostgreSQL users with specific permissions to manage database access and control user privileges for secure database administration.
PostgreSQL users are of the following types:
-
The
postgresLinux system user: Use it only to run the PostgreSQL server and client applications, such aspg_dump. Do not use thepostgressystem user for any interactive work on PostgreSQL administration, such as database creation and user management. -
A database superuser: The default
postgresPostgreSQL superuser is not related to thepostgressystem user. You can limit access of thepostgressuperuser in the/var/lib/pgsql/data/pg_hba.conffile, otherwise no other permission limitations exist. You can also create other database superusers. A role with specific database access permissions:
- A database user: Has a permission to log in by default.
- A group of users: Enables managing permissions for the group as a whole.
Roles can own database objects (for example, tables and functions) and can assign object privileges to other roles by using SQL commands.
Standard database management privileges include SELECT, INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER, CREATE, CONNECT, TEMPORARY, EXECUTE, and USAGE.
Role attributes are special privileges, such as LOGIN, SUPERUSER, CREATEDB, and CREATEROLE.
Perform most tasks as a role that is not a superuser. A common practice is to create a role that has the CREATEDB and CREATEROLE privileges and use this role for all routine management of databases and roles.
Prerequisites
- The PostgreSQL server is installed.
- The database cluster is initialized.
-
The
password_encryptionparameter in the/var/lib/pgsql/data/postgresql.conffile is set toscram-sha-256. -
Entries in the
/var/lib/pgsql/data/pg_hba.conffile use thescram-sha-256hashing algorithm as authentication method.
Procedure
Log in as the
postgressystem user, or switch to this user:# su - postgresStart the PostgreSQL interactive terminal:
$ psql psql (16.4) Type "help" for help. postgres=#Optional: Obtain information about the current database connection:
postgres=# \conninfo You are connected to database "postgres" as user "postgres" via socket in "/var/run/postgresql" at port "5432".Create a user named
mydbuser, set a password for it, and assign theCREATEROLEandCREATEDBpermissions to the user:postgres=# CREATE USER mydbuser WITH PASSWORD '<password>' CREATEROLE CREATEDB; CREATE ROLEThe
mydbuseruser now can perform routine database management operations: create databases and manage user indexes.Log out of the interactive terminal by using the
\qmeta command:postgres=# \q
Verification
Log in to the PostgreSQL terminal as
mydbuser, specify the hostname, and connect to the defaultpostgresdatabase, which was created during initialization:# psql -U mydbuser -h 127.0.0.1 -d postgres Password for user mydbuser: Type the password. psql (16.4) Type "help" for help. postgres=>Create a database:
postgres=> CREATE DATABASE <db_name>;Log out of the session:
postgres=# \qConnect to new database as
mydbuser:# psql -U mydbuser -h 127.0.0.1 -d <db_name> Password for user mydbuser: psql (16.4) Type "help" for help. mydatabase=>