Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1mk8WW-00076n-F5
	for pgsql-admin@arkaria.postgresql.org; Mon, 08 Nov 2021 17:33:36 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1mk8WV-0007vl-AG
	for pgsql-admin@arkaria.postgresql.org; Mon, 08 Nov 2021 17:33:35 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <rui@crazybean.net>)
	id 1mk8WV-0007vc-07
	for pgsql-admin@lists.postgresql.org; Mon, 08 Nov 2021 17:33:35 +0000
Received: from impout004aa.msg.chrl.nc.charter.net ([47.43.20.28]
 helo=impout004.msg.chrl.nc.charter.net)
	by makus.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <rui@crazybean.net>)
	id 1mk8WS-0001A0-6A
	for pgsql-admin@lists.postgresql.org; Mon, 08 Nov 2021 17:33:33 +0000
Received: from cerberus.crazybean.net ([71.11.29.254])
	by cmsmtp with ESMTP
	id k8WQmnxe3nF94k8WQmgWql; Mon, 08 Nov 2021 17:33:30 +0000
Authentication-Results: crazybean.net; none
X-Authority-Analysis: v=2.4 cv=ZIwSJV3b c=1 sm=1 tr=0 ts=61895f6a
 a=GkUsAQdcAzAk0MT19QAIRQ==:117 a=GkUsAQdcAzAk0MT19QAIRQ==:17
 a=xqWC_Br6kY4A:10 a=vIxV3rELxO4A:10 a=hJoSvxYP6tThfyhOaycA:9
 a=CjuIK1q_8ugA:10 a=ihZLPTyl4jgbBNFdZfsA:9 a=wsJ2IY92HJTcdfRF:21
 a=_W_S_7VecoQA:10
Received: from smtpclient.apple (<unknown>
 [2001:470:e117:4:c98d:7968:5a8a:926c])
	by cerberus.crazybean.net (OpenSMTPD) with ESMTPSA id fac84910
 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO);
	Mon, 8 Nov 2021 12:33:29 -0500 (EST)
From: Rui DeSousa <rui@crazybean.net>
Message-Id: <A5BC5082-07CE-485A-B684-4B3127CCB76A@crazybean.net>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_927164D6-D306-452C-9F12-CF989186C2B2"
Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.20.0.1.32\))
Subject: Re: Postgres dying after many failed logins
Date: Mon, 8 Nov 2021 12:33:27 -0500
In-Reply-To: <58143128-71A6-4C51-9BCD-35105A385FA8@cornell.edu>
Cc: "pgsql-admin@lists.postgresql.org" <pgsql-admin@lists.postgresql.org>
To: Lynn Carol Johnson <lcj34@cornell.edu>
References: <58143128-71A6-4C51-9BCD-35105A385FA8@cornell.edu>
X-Mailer: Apple Mail (2.3693.20.0.1.32)
X-CMAE-Envelope: 
 MS4xfGlzCUKBkd5kQnGa18B9pm5RitI6vRpHrXJxEWfZvuEh2P6uWYWmOybMlw6CE7qPhs8iHCDtpJUwsV5D7kvd5tJro5DJDLGmQqpLnl6TwYVefsOMaxmL
 Tqacww34xO4kwET9Wi8M04M/wxIie5MA8LvvuvZbL7xub1lKOuraM4mJcf6BBve7CKQFSG5SlTHSlnja9yQg4MtKlPQSGvMlLhyiCdFD/GGtSbV1uk+irljT
 oCYaZepYNHvmhlX17aZG/A==
List-Id: <pgsql-admin.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-admin@lists.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-admin>
Archived-At: 
 <https://www.postgresql.org/message-id/A5BC5082-07CE-485A-B684-4B3127CCB76A%40crazybean.net>
Precedence: bulk


--Apple-Mail=_927164D6-D306-452C-9F12-CF989186C2B2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii


> On Nov 8, 2021, at 7:45 AM, Lynn Carol Johnson <lcj34@cornell.edu> =
wrote:
>=20
> 2021-11-05 14:35:09.197 UTC [1451469] LOG:  received smart shutdown =
request
> 2021-11-05 14:35:09.222 UTC [1451660] postgres@breedbase FATAL:  =
terminating connection due to administrator command

That does not look like PostgreSQL crashed but is being shutdown by RDS =
services due to a DOS attack. =20

Two things;=20

1. A firewall should be blocking the incoming rouge traffic to protect =
the given server; otherwise the system is open to a DOS attack.
2. Why is PostgreSQL accessible on the internet?  Normally DB servers =
are at least 3 deep from the internet and only internal trusted nodes =
should be connecting to the database.



--Apple-Mail=_927164D6-D306-452C-9F12-CF989186C2B2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><br =
class=3D""><div style=3D"font-size: 19px;"><blockquote type=3D"cite" =
class=3D""><div class=3D"">On Nov 8, 2021, at 7:45 AM, Lynn Carol =
Johnson &lt;<a href=3D"mailto:lcj34@cornell.edu" =
class=3D"">lcj34@cornell.edu</a>&gt; wrote:</div><br =
class=3D"Apple-interchange-newline"><div class=3D""><meta =
charset=3D"UTF-8" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); =
font-family: Helvetica; font-style: normal; font-variant-caps: normal; =
font-weight: normal; letter-spacing: normal; text-align: start; =
text-indent: 0px; text-transform: none; white-space: normal; =
word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: =
none; float: none; display: inline !important;" class=3D"">2021-11-05 =
14:35:09.197 UTC [1451469] LOG: &nbsp;received smart shutdown =
request</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: =
Helvetica; font-style: normal; font-variant-caps: normal; font-weight: =
normal; letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span =
style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-style: =
normal; font-variant-caps: normal; font-weight: normal; letter-spacing: =
normal; text-align: start; text-indent: 0px; text-transform: none; =
white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; =
text-decoration: none; float: none; display: inline !important;" =
class=3D"">2021-11-05 14:35:09.222 UTC [1451660] postgres@breedbase =
FATAL: &nbsp;terminating connection due to administrator =
command</span></div></blockquote></div><br style=3D"font-size: 19px;" =
class=3D""><div style=3D"font-size: 19px;" class=3D"">That does not look =
like PostgreSQL crashed but is being shutdown by RDS services due to a =
DOS attack. &nbsp;</div><div style=3D"font-size: 19px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 19px;" class=3D"">Two =
things;&nbsp;</div><div style=3D"font-size: 19px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 19px;" class=3D"">1. A =
firewall should be blocking the incoming rouge traffic to protect the =
given server; otherwise the system is open to a DOS attack.</div><div =
style=3D"font-size: 19px;" class=3D"">2. Why is PostgreSQL accessible on =
the internet? &nbsp;Normally DB servers are at least 3 deep from the =
internet and only internal trusted nodes should be connecting to the =
database.</div><div style=3D"font-size: 19px;" class=3D""><br =
class=3D""></div><div class=3D""><br class=3D""></div></body></html>=

--Apple-Mail=_927164D6-D306-452C-9F12-CF989186C2B2--