Subject: Re: [bug#77413] [PATCH] services: postgresql-service-type: Allow allowing to log into the user.

From: Ludovic Courtès <[email-masked]>
Date: Tue, 08 Apr 2025 11:48:28 +0200

Hi,

Tomas Volf <[email-masked]> skribis:

> Ludovic Courtès <[email-masked]> writes:

[...]

>> I’m fine with going that route since it make things more convenient, but
>> I think the manual should warn against using (allow-login? #t) in
>> production.
>
> I am willing to make that concession, however before I send a v2, would
> you be able to give few reasons why you think it is a bad idea?  I
> believe the manual should justify the recommendation, and I am currently
> unsure how.
>
> It is common across other distributions to use real shell as a shell for
> the postgres user (I have checked Archlinux, Debian and Alpine), all of
> them are (to at least some degree) suitable for production systems.  The
> link you have shared for cuirass expects the user can use sudo, so at
> that point sudo -s can be used.  In various productions systems I have
> worked with, the postgres user was allowed to be logged into (possibly
> due to running on Debian/Ubuntu).
>
> So I am having somewhat hard time coming up with a one or two concise
> reasons to put into the manual.

To me the motivation would be to reduce the attack surface by not giving
system accounts a shell nor a password.  That also ensures admins don’t
inadvertently run all sorts of processes other than the service itself
under the privilege separation account.

But then again, I’m not a sysadmin; if you say that this is common
practice in the case of the postgresql privilege separation user, then
it’s probably that people consider it good enough, and perhaps we don’t
need a warning.

Thanks,
Ludo’.