Subject: Re: Using Postgres from Unix and security

From: Stuart Pook <[email-masked]>
Date: Wed, 06 May 92 14:34:44 +0200

You write:
> Dear Stuart:
> 
> Jeff Meredith wrote:
>
> "Any postgres user can access any database and examine or modify any relation.
> The postgres rule systems can provide a rather unique way of doing your
> own security.  i.e. defining rules to protect your relations. There is
> currently no builtin mechanism to for determining whose accessing the system,
> but you can define your own function to determine this.

Can you give me an example of how to do this?

> However,
> without network security and serious DBMS support these measures would be
> easy to circumvent."

I have done this (at least to some extent).  I have modified the
postmaster so that it only accepts connections from my subnet and only
connections from privileged tcp ports.  I have modified the monitor so
that it is setuid root, uses a privileged port, and calls getuid(2) and
getpwent(3) to determine the user name to send to the postmaster.  In
this way the user name that the postmaster receives will be correct.
This was easy so I don't really know why somebody has not already done
it.  Perhaps I have missed something obvious.  Once I am sure that I am
not being naive I will post the patches.

The reason that I was forced to make these changes was that the default
configuration allows anybody on the Internet who knows my machine name
(not hard to find out if you look at the header of this mail) and the
port number (the default is 4321) to connect to my postgres server as
any postgres user.  Once connected this person can read or destroy any
database.

Note that I was using the unmodified programs when I discovered that
any unix user (even when they are not being devious) can connect to
postgres.

Stuart Pook

---

From: [email-masked] (Mike Olson)
Date: Wed, 06 May 92 08:49:00 PDT

> not being naive I will post the patches.

restricting connections to those originating on your subnet certainly
reduces the number of people who can mount an attack on your database,
but the approach you describe doesn't solve the security problem.  i
can write a program that does tcp socket operations and obeys the postgres
frontend/backend protocol (easy to do since we distribute source code).
i can have this program send any user name to the postmaster that i want.
the postmaster can't authenticate data coming at it over a network.

you've increased the sophistication required to break into the database
system by a little bit.  denying connections to off-site networks is the
most effective of your tricks, since it means that attackers must at least
have access to one of your local machines.  even this is subvertible, but
breakins from off-site require substantially more work than before.

the right answer is to use kerberos and set up trusted channels between
the postmaster and the libpq process.  there have been enough complaints
that we'll probably do this sometime this summer.

					mike olson
					postgres research group
					uc berkeley
					[email-masked]