4

Greeting, When I install postgres it created default user with username/password = postgres. Lets say I want to deploy to use the database in production. I cant leave the default user like that ,because everyone would be able to log in to my database(people know about this default user).Of course I can restrict the ip from server,but I think its not a good idea.

What should I do. Should I DELETE DEFAULT USER? Should I leave default user,but CHANGE THE PASSWORD?

9
  • 1
    Never delete the superuser (=postgres). If you want to make the installation secure, disallow logins from any other computer for that user (through pg_hba.conf) Commented Jan 26, 2020 at 12:58
  • thanks @a_horse_with_no_name for quick reply. I see your point. Would it also be better if I change the default password for extra security? Commented Jan 26, 2020 at 13:01
  • Yes, change the password. People screw up their pg_hba.conf all the time, changing the password is much more robust. Commented Jan 26, 2020 at 15:46
  • thanks @jjanes for reply. I agree with you completely. I'll definetely change the default password for extra security. Commented Jan 26, 2020 at 16:28
  • 1
    There is no such thing as a "default password" for Postgres Commented Jan 27, 2020 at 8:09

1 Answer 1

4

Good options are:

  • Change or clear the password.

  • Disable logins as postgres:

    ALTER ROLE postgres NOLOGIN;
    

    That second option requires that you either have another superuser or that there is a role that can become postgres with SET ROLE:

    CREATE ROLE admin LOGIN NOINHERIT IN GROUP postgres;
    
Sign up to request clarification or add additional context in comments.

1 Comment

thanks both a_horse_with_no_name and Laurenz for help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.