4.9. Security Considerations

The simplest and most common way of deploying Slony-I is to create a son database user account on all nodes in the system and give that account database superuser privileges. This allows Slony-I to do anything it needs.

4.9.1. Minimum Privileges

The minimum privileges for running each component of Slony-I are:

4.9.1.1. Slonik

The slonik admin connections need to connect to the database as a database superuser. As part of the installation of Slony-I, the slonik program will create C language functions in the database. This requires superuser access. Some slonik commands will enable and disable indicies which by manipulating pg_class. This also requires superuser access.

4.9.1.2. Slon Local Connection

Each slon instance has a 'local' database connection. This is the database connection that is specified on the either the slon command line or the slon configuration file. Slon needs to connect to this database as a superuser. In particular slon needs to have sufficient permissions to:

  • Alter pg_class when preparing to COPY a table

  • Made changes to any of the Slony-I created tables

  • Make modifications to any replicated tables.

4.9.1.3. Slon Remote Connections

The Remote slon connection information is specified in the SLONIK STORE PATH command when adding paths. The slon daemon needs to connect to remote databases with sufficient permissions to:

  • Read (query) the sl_event tables

  • Read (query) the sl_log_1 and sl_log_2 tables

  • Read (query) any replicated tables that originate on the remote node. This is done as part of the initial COPY during the subscription process