postgresql 为什么PostgreSQL中的新用户可以连接所有数据库？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/6884020/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Why new user in PostgreSQL can connect to all databases?
提问by veselej
I installed PostgreSQL 9 database (migration from Oracle10g) and I am realy confused by user/role management. When I create new user using SQL command like CREATE USERor CREATE ROLE, or by Navicat tool, created user can see all databases! He realy can connect them! Although he can't select any data from table, he can see table objects and sequences and so on. I was trying revoke connect privilegia but no effect. I was expected the new user has no privilegia and cant see anything. I really don't know why he can.
我安装了 PostgreSQL 9 数据库（从 Oracle10g 迁移），我对用户/角色管理感到非常困惑。当我使用SQL命令，如创建新的用户CREATE USER或CREATE ROLE，或Navicat的工具，创建用户可以看到所有的数据库！他真的可以把他们联系起来！虽然他不能从表中选择任何数据，但他可以看到表对象和序列等。我试图撤销连接特权但没有效果。我预计新用户没有特权，也看不到任何东西。我真的不知道他为什么可以。
回答by Lekensteyn
From http://www.postgresql.org/docs/9.2/static/sql-grant.html#SQL-GRANT-DESCRIPTION-OBJECTS(emphasis mine):
来自http://www.postgresql.org/docs/9.2/static/sql-grant.html#SQL-GRANT-DESCRIPTION-OBJECTS（强调我的）：
PostgreSQL grants default privileges on some types of objects to
PUBLIC. No privileges are granted toPUBLICby default on tables, columns, schemas or tablespaces. For other types, the default privileges granted toPUBLICare as follows:CONNECTandCREATE TEMP TABLEfor databases;EXECUTEprivilege for functions; andUSAGEprivilege for languages. The object owner can, of course,REVOKEboth default and expressly granted privileges. (For maximum security, issue theREVOKEin the same transaction that creates the object; then there is no window in which another user can use the object.) Also, these initial default privilege settings can be changed using the ALTER DEFAULT PRIVILEGEScommand.
PostgreSQL 将某些类型对象的默认权限授予
PUBLIC.PUBLIC默认情况下不授予对表、列、模式或表空间的权限。对于其他类型，授予的默认权限PUBLIC如下：CONNECT和CREATE TEMP TABLE对于数据库；EXECUTE功能特权；和USAGE语言特权。当然，对象所有者可以REVOKE默认和明确授予的权限。（为了获得最大的安全性，发出REVOKE在创建该对象在同一事务;那么就没有窗口，在其中另一用户可以使用对象）。另外，这些初始缺省权限设置可以使用被改变ALTER缺省权限命令。
In order to remove all privileges (including CONNECT) for all unspecified users on a database, use:
要删除CONNECT数据库上所有未指定用户的所有权限（包括），请使用：
REVOKE ALL PRIVILEGES ON DATABASE <database> FROM public;
See also:
也可以看看：
回答by Daniel Lyons
You probably also need to modify the pg_hba.conffile. By default, a local installation doesn't do authorization checks.
您可能还需要修改该pg_hba.conf文件。默认情况下，本地安装不进行授权检查。
