8

On a shared computer, I have a QGIS project which links up to a PostGIS database that contains my data. If a user wants to access layers from the db, they have to enter the db credentials, so that's OK.

However, I have previously logged on and imported layers from my db into QGIS, and manipulated them in QGIS (styling options based on meta-data, etc.)... Anybody who opens my QGIS project can view these layers in QGIS, and can therefore see the data I wish to be protected in my db.

Is there a way to password protect my QGIS project?

  • That won't work unfortunately, it's a shared computer used by multiple people. – RJK57 Aug 10 '15 at 12:52
11

Your best bet is going to be not saving the db credentials in your project (QGIS even gives you a warning on the potential danger of saving your credentials when you first add the db).

When you open the project, you'll immediately be prompted for your credentials before any layers from the db are rendered.

Alternatively, you can:

  • Use OS methods to hide/protect the directory where your QGIS project is stored, ie only your user account can access that particular directory
  • You could try your hand at running a Python script on project open that might ask for credentials, though in the 5 minutes I spent trying that, could not get this to work. Check out Project Properties (CTRL+Shift+P) and then Macros to see what I mean.

To follow up on the danger of saving your db credentials in QGIS, see this question. It's trivial for anyone with the slightest curiosity to see your credentials in plain text.

  • Thanks for your response. I'm already not saving the db credentials. Also, I don't see the behaviour you've described above. Even if the user does not provide db credentials, after cancelling the prompt box he can access a bunch of layers in QGIS whose data source is from the db. – RJK57 Aug 10 '15 at 16:21
  • Open the project file with a text editor and find the <datasource> tags. There must be credentials saved, because the expected behavior after closing the prompt without entering anything is a 'Connection failed' result. – wchatx Aug 10 '15 at 18:46
  • Did you check the right management of the table? Maybe the "public" role has SELECT right. That's maybe why after cancelling the prompt box the user can still access it. – aurel_nc Aug 11 '15 at 2:34
  • @wchatx Thanks, that did the trick! Opened up the project in Notepad++, and deleted all references to username=foo password=bar. The issue as far I can see is that, my test database just used the admin login/password, i.e. postgres/postgres. After I decided to use the PostGIS/QGIS stack I changed the password. Whilst not entering the correct username/password in QGIS blocked access to layers I'd imported with the updated password, for some reason older layers (imported with the postgres/postgres config) were OK since the credentials were saved in the database. – RJK57 Aug 12 '15 at 12:41
  • @RJK57 Excellent! – wchatx Aug 12 '15 at 19:34
3

There was a similar question I answered here. I didn't go too far into setting up an idea on how to create the login form, although much of a logic is there.

If you can trust your users not to try to get into your python code (or compile to an .exe to make it even harder), you could create a script that will either open up the project with the layers loaded in it, or an empty project if they are unable to supply the correct credentials.

There was talk of checking the information against a server for a more secure method, which you could implement in your Postgres/PostGIS instance. You could find as a more simple stopgap to code in your user name and a hashed password into your python code that feeds to an API for verification. So let your server do the comparison instead of your desktop code. Storing your hashed password locally isn't the most secure way of doing things, but depending on your hash algorithm, it could potentially be pretty difficult to crack it.

Ultimately, it is probably more secure to just supply your credentials every time unless you know the other users aren't computer savvy enough to figure out any of the automated methods you'd supply.

  • Thanks for your response. I will attempt to implement some kind of form and respond back to the question if I crack it... – RJK57 Aug 10 '15 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.