pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedDisable TRUST authentication mode
12+ messages / 5 participants
[nested] [flat]
* Disable TRUST authentication mode
@ 2012-03-10 15:00 c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
0 siblings, 1 reply; 12+ messages in thread
From: c k @ 2012-03-10 15:00 UTC (permalink / raw)
To: pgsql-admin
Hi,
Can we disable the trust authentication mode?
One of our customer found that few of it's employees are trying to change
the data without having any proper rights. The simplest way is to get the
control of the server and then change the mode of the authentication to
trust and restart the server. All other regular users will do not get any
problems for their daily working. And this is the real fact that persons
from IT department can be one of the users who are going to make a fraud.
Even after having sufficient logging and other preventative actions, like
logging in the database for what is changed (audit trails) and even using
postgresql logs, it impossible to prevent such things. As in most of the
times we use username/password as basic functionality to prevent
unauthorised users from getting the database access, TRUST makes a grand
back door for hackers or fraud making users to get into the database. In
TRUST mode knowing the name of the user is sufficient and it is not hard to
know the superuser login name.
What steps we can take to prevent such access or to disable the TRUST mode
completely?
Thanks,
C P Kulkarni
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
@ 2012-03-10 15:09 ` Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:15 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:16 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
0 siblings, 2 replies; 12+ messages in thread
From: Jan Lentfer @ 2012-03-10 15:09 UTC (permalink / raw)
To: pgsql-admin
Am 10.03.2012 16:00, schrieb c k:
> Can we disable the trust authentication mode?
[...]
> What steps we can take to prevent such access or to disable the TRUST
> mode completely?
Sorry, maybe I do not entirely understand what you mean, but just >don't
use< trust in you pg_hba.conf?
Jan
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
@ 2012-03-10 15:15 ` c k <shreeseva.learning@gmail.com>
2012-03-10 15:19 ` Re: Disable TRUST authentication mode Frank Lanitz <frank@frank.uvena.de>
1 sibling, 1 reply; 12+ messages in thread
From: c k @ 2012-03-10 15:15 UTC (permalink / raw)
To: Jan Lentfer <Jan.Lentfer@web.de>; pgsql-admin
I am not managing the customer database. The problem is related with the IT
department of the customer who has the access to the database server and
the fraud persons from this department can chnage the authentication to
trust to get the access to database without knowing the passwords and even
to superuser accounts.
C P Kulkarni
On Sat, Mar 10, 2012 at 8:39 PM, Jan Lentfer <Jan.Lentfer@web.de> wrote:
> Am 10.03.2012 16:00, schrieb c k:
>
>
> Can we disable the trust authentication mode?
>>
>
> [...]
>
>
> What steps we can take to prevent such access or to disable the TRUST
>> mode completely?
>>
>
> Sorry, maybe I do not entirely understand what you mean, but just >don't
> use< trust in you pg_hba.conf?
>
> Jan
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/**mailpref/pgsql-admin<http://www.postgresql.org/mailpref/pgsql-admin;
>
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:15 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
@ 2012-03-10 15:19 ` Frank Lanitz <frank@frank.uvena.de>
0 siblings, 0 replies; 12+ messages in thread
From: Frank Lanitz @ 2012-03-10 15:19 UTC (permalink / raw)
To: pgsql-admin
On Sat, 10 Mar 2012 20:45:38 +0530
c k <shreeseva.learning@gmail.com> wrote:
> I am not managing the customer database. The problem is related with
> the IT department of the customer who has the access to the database
> server and the fraud persons from this department can chnage the
> authentication to trust to get the access to database without knowing
> the passwords and even to superuser accounts.
This most likely sounds like a social problem you _cannot_ solve with
technique. However, ensure users you don't trust are not allowed to
write pg_hba.conf e.g. by don't giving root/postgres-user rights on
that machine.
Cheers,
Frank
--
Frank Lanitz <frank@frank.uvena.de>
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
@ 2012-03-10 15:16 ` Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:21 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
1 sibling, 1 reply; 12+ messages in thread
From: Jan Lentfer @ 2012-03-10 15:16 UTC (permalink / raw)
To: pgsql-admin
Am 10.03.2012 16:09, schrieb Jan Lentfer:
> Sorry, maybe I do not entirely understand what you mean, but just >don't
> use< trust in you pg_hba.conf?
Reading it again, I'd say this is your problem:
"The simplest way is >to get the control of the server< and then change
the mode of the authentication to trust and restart the server."
If anyone can do that with your server, how would disabling trust
improve anything?
Jan
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:16 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
@ 2012-03-10 15:21 ` c k <shreeseva.learning@gmail.com>
2012-03-10 15:26 ` Re: Disable TRUST authentication mode Frank Lanitz <frank@frank.uvena.de>
2012-03-10 15:28 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
0 siblings, 2 replies; 12+ messages in thread
From: c k @ 2012-03-10 15:21 UTC (permalink / raw)
To: Jan Lentfer <Jan.Lentfer@web.de>; pgsql-admin
It we can disable the TRUST mode then every user have to login with
password and every fraud user have to know the password (at least) of the
user. It is not the case that users from other departments share their
passwords, but fraud users just bypasses the need to know the password.
C P Kulkarni
On Sat, Mar 10, 2012 at 8:46 PM, Jan Lentfer <Jan.Lentfer@web.de> wrote:
> Am 10.03.2012 16:09, schrieb Jan Lentfer:
>
> Sorry, maybe I do not entirely understand what you mean, but just >don't
>> use< trust in you pg_hba.conf?
>>
>
> Reading it again, I'd say this is your problem:
>
>
> "The simplest way is >to get the control of the server< and then change
> the mode of the authentication to trust and restart the server."
>
>
> If anyone can do that with your server, how would disabling trust improve
> anything?
>
>
> Jan
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/**mailpref/pgsql-admin<http://www.postgresql.org/mailpref/pgsql-admin;
>
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:16 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:21 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
@ 2012-03-10 15:26 ` Frank Lanitz <frank@frank.uvena.de>
1 sibling, 0 replies; 12+ messages in thread
From: Frank Lanitz @ 2012-03-10 15:26 UTC (permalink / raw)
To: pgsql-admin
On Sat, 10 Mar 2012 20:51:58 +0530
c k <shreeseva.learning@gmail.com> wrote:
> It we can disable the TRUST mode then every user have to login with
> password and every fraud user have to know the password (at least) of
> the user. It is not the case that users from other departments share
> their passwords, but fraud users just bypasses the need to know the
> password.
Users that are able to change pg_hba.conf are most likely also able to
replace any binary at the system. Even you are right that the trust
option is a bit dangerous, but its not your root issue.
Cheers,
Frank
--
Frank Lanitz <frank@frank.uvena.de>
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:16 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:21 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
@ 2012-03-10 15:28 ` Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 16:20 ` Re: Disable TRUST authentication mode Tom Lane <tgl@sss.pgh.pa.us>
2012-03-10 16:20 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
1 sibling, 2 replies; 12+ messages in thread
From: Jan Lentfer @ 2012-03-10 15:28 UTC (permalink / raw)
To: c k <shreeseva.learning@gmail.com>; +Cc: pgsql-admin
Am 10.03.2012 16:21, schrieb c k:
> It we can disable the TRUST mode then every user have to login with
> password and every fraud user have to know the password (at least) of
> the user. It is not the case that users from other departments share
> their passwords, but fraud users just bypasses the need to know the
> password.
If they can alter pg_hba.conf they can almost certainly also change/add
users, alter passwords, etc, etc... So from a security perspective it
doesn't buy you much.
I don't know if you could build a custom postgresql from sources with
trust disabled. But it wouldn't be worth the trouble imo.
Jan
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:16 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:21 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:28 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
@ 2012-03-10 16:20 ` Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 0 replies; 12+ messages in thread
From: Tom Lane @ 2012-03-10 16:20 UTC (permalink / raw)
To: Jan Lentfer <Jan.Lentfer@web.de>; +Cc: c k <shreeseva.learning@gmail.com>; pgsql-admin
Jan Lentfer <Jan.Lentfer@web.de> writes:
> Am 10.03.2012 16:21, schrieb c k:
>> It we can disable the TRUST mode then every user have to login with
>> password and every fraud user have to know the password (at least) of
>> the user. It is not the case that users from other departments share
>> their passwords, but fraud users just bypasses the need to know the
>> password.
> If they can alter pg_hba.conf they can almost certainly also change/add
> users, alter passwords, etc, etc... So from a security perspective it
> doesn't buy you much.
Somebody who has the ability to rewrite pg_hba.conf could also go in and
physically alter the database files -- those are in the same directory
tree, with the same ownership and permissions, as pg_hba.conf. If you
cannot trust people who have that level of access, you have a problem
that software cannot solve for you. You need to rethink who has got
access to the machine running the database server, or at least who has
got root on it.
regards, tom lane
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:16 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:21 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:28 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
@ 2012-03-10 16:20 ` c k <shreeseva.learning@gmail.com>
2012-03-10 17:06 ` Re: Disable TRUST authentication mode Frank Lanitz <frank@frank.uvena.de>
1 sibling, 1 reply; 12+ messages in thread
From: c k @ 2012-03-10 16:20 UTC (permalink / raw)
To: pgsql-admin
Thanks to all.
I understand that the users who have the access to the system can also
change binaries. We are also thinking about the same. Using a virtual
server for the database with almost 80% of the system resource where even
persons from the IT department does not have the root access and do not
know passwords for the superusers of the database or do not have the access
to the filesystem of the virtual server can be a solution. Is it?
If any postgresql user have the experience to deal with the situations
like, please share your experiences.
Thanks and regards,
C P Kulkarni
On Sat, Mar 10, 2012 at 8:58 PM, Jan Lentfer <Jan.Lentfer@web.de> wrote:
> Am 10.03.2012 16:21, schrieb c k:
>
> It we can disable the TRUST mode then every user have to login with
>> password and every fraud user have to know the password (at least) of
>> the user. It is not the case that users from other departments share
>> their passwords, but fraud users just bypasses the need to know the
>> password.
>>
>
> If they can alter pg_hba.conf they can almost certainly also change/add
> users, alter passwords, etc, etc... So from a security perspective it
> doesn't buy you much.
>
> I don't know if you could build a custom postgresql from sources with
> trust disabled. But it wouldn't be worth the trouble imo.
>
>
> Jan
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/**mailpref/pgsql-admin<http://www.postgresql.org/mailpref/pgsql-admin;
>
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:16 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:21 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:28 ` Re: Disable TRUST authentication mode Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 16:20 ` Re: Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
@ 2012-03-10 17:06 ` Frank Lanitz <frank@frank.uvena.de>
0 siblings, 0 replies; 12+ messages in thread
From: Frank Lanitz @ 2012-03-10 17:06 UTC (permalink / raw)
To: pgsql-admin
On Sat, 10 Mar 2012 21:50:32 +0530
c k <shreeseva.learning@gmail.com> wrote:
> I understand that the users who have the access to the system can also
> change binaries. We are also thinking about the same. Using a virtual
> server for the database with almost 80% of the system resource where
> even persons from the IT department does not have the root access and
> do not know passwords for the superusers of the database or do not
> have the access to the filesystem of the virtual server can be a
> solution. Is it?
Well... maybe we should start at root of issue as this is what I still
don't understand: Why shouldn't have you staff access to the database?
Somebody has to administrate database.... If you need to keep content
of some tables secure, did you think about storing encrypted objects
inside database?
Cheers,
Frank
--
Frank Lanitz <frank@frank.uvena.de>
^ permalink raw reply [nested|flat] 12+ messages in thread
* Re: Disable TRUST authentication mode
@ 2012-03-10 16:38 Kevin Grittner <Kevin.Grittner@wicourts.gov>
0 siblings, 0 replies; 12+ messages in thread
From: Kevin Grittner @ 2012-03-10 16:38 UTC (permalink / raw)
To: shreeseva.learning@gmail.com; pgsql-admin
c k wrote:
> One of our customer found that few of it's employees are trying to
> change the data without having any proper rights. The simplest way
> is to get the control of the server and then change the mode of the
> authentication to trust and restart the server.
There's your problem right there.
I once had the great pleasure and honor of attending a luncheon where
Admiral Grace Hopper[1] spoke. One of the topics she addressed was
security. She emphasized that if someone has physical access to your
hardware, the game is over. She asserted that if anyone in the room
gave her ten minutes alone with their computer, she could breach
security, and dared those in attendance to let her prove it.
(Nobody took her up on it.)
Without getting into gory details, I realize that there are
techniques which could make certain types of attack difficult even
with physical access, but there are some absolute security
deal-breakers. If someone can log on to the OS running your database
as the root user, you had better trust that person, because they can
do pretty much anything. Any sense that you're secure in the face of
an untrusted user with root access is purely illusionary. What's to
stop them from creating a custom version of any software (including
PostgreSQL) which has a back-door access that lets them in?
It seems to me that you either need to look at providing your
software as a service, so that you retain control of the hardware, or
educate your customers on security principles.
-Kevin
[1] http://en.wikipedia.org/wiki/Grace_Hopper
^ permalink raw reply [nested|flat] 12+ messages in thread
end of thread, other threads:[~2012-03-10 17:06 UTC | newest]
Thread overview: 12+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2012-03-10 15:00 Disable TRUST authentication mode c k <shreeseva.learning@gmail.com>
2012-03-10 15:09 ` Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:15 ` c k <shreeseva.learning@gmail.com>
2012-03-10 15:19 ` Frank Lanitz <frank@frank.uvena.de>
2012-03-10 15:16 ` Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 15:21 ` c k <shreeseva.learning@gmail.com>
2012-03-10 15:26 ` Frank Lanitz <frank@frank.uvena.de>
2012-03-10 15:28 ` Jan Lentfer <Jan.Lentfer@web.de>
2012-03-10 16:20 ` Tom Lane <tgl@sss.pgh.pa.us>
2012-03-10 16:20 ` c k <shreeseva.learning@gmail.com>
2012-03-10 17:06 ` Frank Lanitz <frank@frank.uvena.de>
2012-03-10 16:38 Re: Disable TRUST authentication mode Kevin Grittner <Kevin.Grittner@wicourts.gov>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox