Subject: Re: Using Postgres from Unix and security

From: Stuart Pook <[email-masked]>
Date: Wed, 06 May 92 18:17:07 +0200

Mike Olson writes:
> In message <[email-masked]> you write:
> 
> > I have done this (at least to some extent).  I have modified the
> > postmaster so that it only accepts connections from my subnet and only
> > connections from privileged tcp ports.  I have modified the monitor so
> > that it is setuid root, uses a privileged port, and calls getuid(2) and
> > getpwent(3) to determine the user name to send to the postmaster.  In
> > this way the user name that the postmaster receives will be correct.
> > This was easy so I don't really know why somebody has not already done
> > it.  Perhaps I have missed something obvious.  Once I am sure that I am
> > not being naive I will post the patches.
> 
> restricting connections to those originating on your subnet certainly
> reduces the number of people who can mount an attack on your database,
> but the approach you describe doesn't solve the security problem.  i
> can write a program that does tcp socket operations and obeys the postgres
> frontend/backend protocol (easy to do since we distribute source code).
> i can have this program send any user name to the postmaster that i want.
> the postmaster can't authenticate data coming at it over a network.

I think that you have only looked at half of what I have done.  You,
or somebody on one of the machines in my subnet, _cannot_
talk to my postmaster because it only accepts connections coming in a
priviliged tcp port (ie a port number less than 1024).  Only a root process
can open such a port.  So only you cannot create a program which talks to
my postmaster unless you are root on one of the machines on my subnet.
My monitor, which is setuid root, will only send your real unix user name,
as found in /etc/passwd under your user id, to the postmaster.  This is,
I think, sufficient to solve the security problem on a subnet under a single
administration.

To repeat, you say:
> the postmaster can't authenticate data coming at it over a network.
If the port number is less than 1024 it knows that it is talking to root,
and my postmaster will only allow a connection in this case; and in this
case it _can_ believe the supplied user name.

Stuart Pook

---

From: [email-masked] (Mike Olson)
Date: Wed, 06 May 92 09:28:48 PDT

In message <[email-masked]> you write:

> priviliged tcp port (ie a port number less than 1024).

you're right, i wasn't thinking.

since kerberos supports authentication without resorting to super-user
privileges, we'll take that approach for the officially supported release.
however, your fixes do what you claim they do -- you can't crack the
database system without cracking root somewhere on your subnet.

					mike

---

From: George Hartzell <[email-masked]>
Date: Wed, 6 May 92 11:40:16 -0700

>database system without cracking root somewhere on your subnet.

I'm not too familiar with the tcp/ip libraries for Macs and PC's, but
I'd worry that they might let you use an arbitrary port.  If that's
true, then having them on your subnet would be a problem.

g.