通过连接到远程PostgreSQL服务器访问文件系统

Question

We have PostgreSQL running on a unix box, and multiple users with both individual unix accounts and individual database logins. The kind of workflow we are trying to enable for these users is:

1. Transfer a large file to the server (typically via Samba)
2. Establish a remote connection from the user's PC to PostgreSQL
3. Read the large file into a (preferably temporary) table and do some analysis

The stumbling block is how to access the file while logged into PostgreSQL. At first glance this seems impossible to do securely, because the database is running under the postgres account, which doesn't even have access to files belonging to other unix accounts. Out of the box, I believe the only way that PostgreSQL users could access local files would be to (a) make the files readable by the postgres unix account, and (b) give the database users elevated privileges to allow them to use the COPY FROM command in Postgres. This is out of the question; the users must not be able to read each other's data.

The workaround we are currently using is to shell into the server and run psql , which allows the user to slurp in data from a local file using the \\copy meta-command. But this complicates the workflow and is not very satisfactory to our users, who are mostly unfamiliar with unix. Instead, they would like to drive the whole process from PC-based analytics package called SAS, which can connect directly to Postgres via ODBC.

I am looking for a creative solution to this problem. Clearly, the naive workflow I listed above is completely at odds with the unix security model. But is there an alternative which will function similarly from the user's point of view? We're happy to consider stored procedures, man-in-the-middle proxies, etc.

Answer 1

If your users are connecting via SAS, can they upload the files themselves via the SAS-PSQL connection? Speaking as a SAS user this is certainly possible; something like

libname psql odbc (connection-string);
data psql.mytable;
set sastable;
run;

Of course that requires it being read into SAS locally first, but that is likely trivial. The main potential issue here is time - it is undoubtedly slower to transfer this way than over SAMBA; but perhaps the time taken is worth it for the simplicity?