Date: Tue, 22 Sep 2020 14:07:40 +0000 (UTC)
From: MUKESH PRASAD <mukeshprasad_hit@yahoo.co.in>
Reply-To: MUKESH PRASAD <mukeshprasad_hit@yahoo.co.in>
To: Geoff Winkless <pgsqladmin@geoff.dj>,
	"pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>
Message-ID: <634841077.3807388.1600783660380@mail.yahoo.com>
In-Reply-To: 
 <CAEzk6fdc+HuRj6AWObaaLf6bwmR-CqP2H0MTbgnSTvhYnwomow@mail.gmail.com>
References: <784638453.3796012.1600781634382.ref@mail.yahoo.com>
 <784638453.3796012.1600781634382@mail.yahoo.com>
 <CAEzk6fdc+HuRj6AWObaaLf6bwmR-CqP2H0MTbgnSTvhYnwomow@mail.gmail.com>
Subject: Re: The default database account can be accessed without a password
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_3807387_25604164.1600783660379"
Content-Length: 3086
Precedence: bulk

------=_Part_3807387_25604164.1600783660379
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Geoff,=C2=A0Yes it is allowed for all the hosts in same subnet.=C2=A0
host all all 10.10.10.0/24 trust
Regards,Mukesh Prasad

Sent from Yahoo Mail on Android=20
=20
  On Tue, 22 Sep 2020 at 7:10 PM, Geoff Winkless<pgsqladmin@geoff.dj> wrote=
:   On Tue, 22 Sep 2020 at 14:33, MUKESH PRASAD
<mukeshprasad_hit@yahoo.co.in> wrote:
> I am getting VA with CVE I'd 1999-0508 where it says my default database =
is unpassword. However I checked all the dB with \l command and In none of =
the database I am able to login without password.
>
> It refers to the default postgres user and I have changed password too mu=
ltiple times but still it complaints.

Do you have "trust" for any lines in pg_hba.conf?

Geoff
 =20

------=_Part_3807387_25604164.1600783660379
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Geoff,&nbsp;<div id=3D"yMail_cursorElementTracker_1600783594395">Yes it =
is allowed for all the hosts in same subnet.&nbsp;</div><div id=3D"yMail_cu=
rsorElementTracker_1600783616170"><br></div><div id=3D"yMail_cursorElementT=
racker_1600783616982">host all all 10.10.10.0/24 trust</div><div id=3D"yMai=
l_cursorElementTracker_1600783641756"><br></div><div id=3D"yMail_cursorElem=
entTracker_1600783642662">Regards,</div><div id=3D"yMail_cursorElementTrack=
er_1600783646076">Mukesh Prasad<br><br><div id=3D"ymail_android_signature">=
<a id=3D"ymail_android_signature_link" href=3D"https://go.onelink.me/107872=
968?pid=3DInProduct&amp;c=3DGlobal_Internal_YGrowth_AndroidEmailSig__Androi=
dUsers&amp;af_wl=3Dym&amp;af_sub1=3DInternal&amp;af_sub2=3DGlobal_YGrowth&a=
mp;af_sub3=3DEmailSignature">Sent from Yahoo Mail on Android</a></div> <br>=
 <blockquote style=3D"margin: 0 0 20px 0;"> <div style=3D"font-family:Robot=
o, sans-serif; color:#6D00F6;"> <div>On Tue, 22 Sep 2020 at 7:10 PM, Geoff =
Winkless</div><div>&lt;pgsqladmin@geoff.dj&gt; wrote:</div> </div> <div sty=
le=3D"padding: 10px 0 0 20px; margin: 10px 0 0 0; border-left: 1px solid #6=
D00F6;"> On Tue, 22 Sep 2020 at 14:33, MUKESH PRASAD<div class=3D"yqt739543=
5773" id=3D"yqtfd94186"><br clear=3D"none">&lt;<a shape=3D"rect" ymailto=3D=
"mailto:mukeshprasad_hit@yahoo.co.in" href=3D"mailto:mukeshprasad_hit@yahoo=
.co.in">mukeshprasad_hit@yahoo.co.in</a>&gt; wrote:<br clear=3D"none">&gt; =
I am getting VA with CVE I'd 1999-0508 where it says my default database is=
 unpassword. However I checked all the dB with \l command and In none of th=
e database I am able to login without password.<br clear=3D"none">&gt;<br c=
lear=3D"none">&gt; It refers to the default postgres user and I have change=
d password too multiple times but still it complaints.</div><br clear=3D"no=
ne"><br clear=3D"none">Do you have "trust" for any lines in pg_hba.conf?<br=
 clear=3D"none"><br clear=3D"none">Geoff<div class=3D"yqt7395435773" id=3D"=
yqtfd30301"><br clear=3D"none"></div> </div> </blockquote></div>
------=_Part_3807387_25604164.1600783660379--