Configure Security and Permissions
These topics cover three layers of protection: controlling who can connect, controlling what they can do once connected, and protecting data at rest and in transit.
Authentication and passwords
Set client authentication methods in pg_hba.conf; passwords are stored encrypted with MD5 or SCRAM.
Use the PasswordCheck plugin to reject weak passwords.
Access control
Control access through roles and privileges, administered with SQL statements or command-line tools.
Detailed session-level or object-level audit logging through the standard PostgreSQL logging facility.
Protect data
An encryption module protecting data at rest and in transit.
Transparent Data Encryption operates at the data file level, invisible to applications above.
An anonymization extension based on PostgreSQL Anonymizer, for sharing data with unauthorized parties.