You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
User barman is a regular user with the required set of privileges.
Run following command: barman --log-level DEBUG switch-wal --force ssh-pg-master
As expected and described in the documentation this will fail because the --force option requires superuser attritbute:
ERROR: Barman switch-wal requires superuser rights
Run command without --force: barman --log-level DEBUG switch-wal ssh-pg-master
It is expected that the command runs correctly, but in stead it returns an exception:
EXCEPTION:
See log file for more details.
Checking the postgresql logfile it can be seen that the same wrong query is used to check if user has all needed privileges as described in issue #318
From barman logfile a python exception can be seen in stead of a more user friendly error message.
Proposal:
Catch current exception and give a correct warning message (when conditions aren't met) like:
Privileges for PostgreSQL backup functions are required (see documentation)
We require two Postgres users, barman (a superuser) and streaming_barman
(a non-superuser with replication privileges). We connect as user barman
to execute queries (e.g., read pg_settings, or run pg_start_backup), and
as streaming_barman to create a replication slot and run pg_receivewal.
In Postgres v10+, the barman user does not need to be a superuser, but
can be a regular user that is granted permissions to read settings and
execute backup functions. Commit #8f5a5af added support for this setup,
but incorrectly introduced "userepl" privileges into the equation.
The barman user does not need the "replication" privilege, which grants
neither EXECUTE permissions on backup functions, nor the ability to read
settings (i.e., doing `createuser --replication barman` would still mean
having to GRANT all required privileges separately).
As reported in #318 and #319, this confusion results in some unfortunate
behaviour (a failing check and an empty exception). We fix both problems
here by removing userepl from the has_backup_privileges query, and also
introducing a better exception message.
Now if the barman user is not a superuser, it must be a member of the
pg_read_all_{stats,settings} roles (or a member of pg_monitor, which
implies both), and it must also have EXECUTE privileges on functions
pg_{start,stop}_backup, pg_create_restore_point, and pg_switch_wal.
The requirements for streaming_barman are unchanged; it must have
replication privileges.
Closes#318Closes#319
barman 2.12
postgresql 13.1
Following configuration for server:
User barman is a regular user with the required set of privileges.
Run following command:
barman --log-level DEBUG switch-wal --force ssh-pg-master
As expected and described in the documentation this will fail because the --force option requires superuser attritbute:
ERROR: Barman switch-wal requires superuser rights
Run command without --force:
barman --log-level DEBUG switch-wal ssh-pg-master
It is expected that the command runs correctly, but in stead it returns an exception:
EXCEPTION:
See log file for more details.
Checking the postgresql logfile it can be seen that the same wrong query is used to check if user has all needed privileges as described in issue #318
From barman logfile a python exception can be seen in stead of a more user friendly error message.
Proposal:
Catch current exception and give a correct warning message (when conditions aren't met) like:
Privileges for PostgreSQL backup functions are required (see documentation)
barman2.log
postgres2.log
The text was updated successfully, but these errors were encountered: