一、環境

#配置遠程連接

su postgres  
vim /var/lib/pgsql/9.4/data/postgresql.conf   編輯配置文件  
listen_address=’localhost’ 前面的註釋#去掉，並把’localhost’該為’*’;  
vim /etc/postgresql/8.2/main/pg_hba.conf  
host all all 192.168.1.0/24 password    password 可以設置為trust  
/etc/init.d/postgresql-8.2 restart 重啟服務：還有stop start命令一樣的。如果配置錯誤可能導致無法重啟

二、語法：

psql -U postgres #進入數據庫
\l #查看有哪些數據庫 
\c postgresql  #選擇postgresql 這個數據庫，會提示進入連接 
\dt #查看所有表
\d tablename #查看某張表結構
\h #查看幫助

三、創建只讀用戶

#1.創建表
create table t1 ( id serial, name varchar(64) );
CREATE TABLE
postgres=# \dt        List of relations
 Schema | Name | Type  |  Owner   
--------+------+-------+----------
 public | t1   | table | postgres
(1 row)

2.創建用戶u1
create role u1 with login password ‘123456‘; #login是賦予登錄權限，否則是不能登錄的
CREATE ROLE

3.賦予u1對表的只讀權限（因為創建的普通用戶默認是沒有任何權限的）
postgres=# \c - u1
FATAL:  Peer authentication failed for user "u2"  
Previous connection kept

如果出現以上信息，則需改配置文件：
vim /etc/postgresql/9.6/main/pg_hba.conf
找到下面的一行：
local   all             postgres                                peer
改成：
local   all             postgres                                trust

如果出現下面的錯誤：
FATAL: Peer authentication failed foruser "mypguser"

請仍然修改pg_hba.conf文件，該下面行的peer為md5：
local   all    all    md5       # replace peer with md5
    
完成上面的修改後請重新加載postgresql：
/etc/init.d/postgresql reload

postgres=> select * from t1;
ERROR:  permission denied for relation t1
postgres=> \c - postgres
You are now connected to database "postgres" as user "postgres".
postgres=# grant select on all tables in schema public to u1;
GRANT
postgres=# \c - u1You are now connected to database "postgres" as user "u1".
postgres=> select * from t1;
 id | name 
----+------
(0 rows)

4.創建表t2
postgres=> \c - postgres
You are now connected to database "postgres" as user "postgres".
postgres=# create table t2 ( id serial, name varchar(64) );
CREATE TABLE
postgres=# \dt        List of relations
 Schema | Name | Type  |  Owner   
--------+------+-------+----------
 public | t1   | table | postgres
 public | t2   | table | postgres
(2 rows)

5.驗證u1的權限
postgres=# \c - u1You are now connected to database "postgres" as user "u1".
postgres=> select * from t1;
 id | name 
----+------
(0 rows)

postgres=> select * from t2;
ERROR:  permission denied for relation t2 

可見u1是有t1表的讀權限，但沒有t2表的讀權限，這樣是不是意味著每次新建表就要賦一次權限？

6.解決辦法
postgres=> \c - postgres
You are now connected to database "postgres" as user "postgres".
postgres=# alter default privileges in schema public grant select on tables to u1;
ALTER DEFAULT PRIVILEGES
# grant是賦予用戶schema下當前表的權限
# alter default privileges是賦予用戶schema下表的默認權限

postgres=# create table t3 ( id serial, name varchar(64) );
CREATE TABLE
postgres=# \dt        List of relations
 Schema | Name | Type  |  Owner   
--------+------+-------+----------
 public | t1   | table | postgres
 public | t2   | table | postgres
 public | t3   | table | postgres
(3 rows)

四、創建可更新用戶

1.創建u2用戶
postgres=# create role u2 with login password ‘123456‘;
CREATE ROLE

2.賦予更新權限
postgres=# alter default privileges in schema public grant select,insert,update,delete on tables to u2;
ALTER DEFAULT PRIVILEGES

3.創建表t4
postgres=# create table t4 ( id serial, name varchar(64) );CREATE TABLE
postgres=# \dt        List of relations
 Schema | Name | Type  |  Owner   
--------+------+-------+----------
 public | t1   | table | postgres
 public | t2   | table | postgres
 public | t3   | table | postgres
 public | t4   | table | postgres
(4 rows)

4.查看權限
postgres=# \c - u2You are now connected to database "postgres" as user "u2".
postgres=> insert into t4 values ( 1, ‘aa‘ );
INSERT 0 1
postgres=> select * from t4;
 id | name 
----+------
  1 | aa
(1 row)

postgres=> update t4 set name = ‘bb‘ where id = 1;
UPDATE 1
postgres=> select * from t4;
 id | name 
----+------
  1 | bb
(1 row)

postgres=> delete from t4 where id = 1;
DELETE 1
postgres=> select * from t4;
 id | name 
----+------
(0 rows)

5.序列的權限與解決辦法
# 在insert的時候，指定列插入，主鍵id是serial類型會默認走sequence的下一個值，但前面
# 只賦予了表的權限，所以會出現下面的問題：

postgres=> insert into t4 ( name ) values ( ‘aa‘ );
ERROR:  permission denied for sequence t4_id_seq

# 解決方法就是再賦一次sequence的值就行了
postgres=> \c - postgres
You are now connected to database "postgres" as user "postgres".
postgres=# alter default privileges in schema public grant usage on sequences to u2;
ALTER DEFAULT PRIVILEGES
postgres=# create table t5 ( id serial, name varchar(64) );
CREATE TABLE
postgres=# \c - u2
You are now connected to database "postgres" as user "u2".
postgres=> insert into t5 ( name ) values ( ‘cc‘ );
INSERT 0 1postgres=> select * from t5;
 id | name 
----+------
  1 | cc
(1 row)

五、刪除用戶

postgres=> \c - postgres
You are now connected to database "postgres" as user "postgres".
postgres=# drop role u2;
ERROR:  role "u2" cannot be dropped because some objects depend on it
DETAIL:  privileges for table t5
privileges for sequence t5_id_seq
privileges for default privileges on new sequences belonging to role postgres in schema publicprivileges for table t4
privileges for default privileges on new relations belonging to role postgres in schema public

# 當我們刪除用戶的時候，會提示有權限依賴，所以我們要刪除這些權限
postgres=# alter default privileges in schema public revoke usage on sequences from u2;
ALTER DEFAULT PRIVILEGES
postgres=# alter default privileges in schema public revoke select,insert,delete,update on tables from u2;
ALTER DEFAULT PRIVILEGES
postgres=# revoke select,insert,delete,update on all tables in schema public from u2;
REVOKE
postgres=# revoke usage on all sequences in schema public from u2;
REVOKE
postgres=# drop role u2;
DROP ROLE

六、修改用戶密碼

sudo -u postgres psql
ALTER USER postgres WITH PASSWORD ‘passwd‘;

Postgresql 學習筆記（1）