pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Pavel Borisov <pashkin.elfe@gmail.com>
Cc: noloader@gmail.com, Magnus Hagander <magnus@hagander.net>
Cc: PostgreSQL mailing lists <pgsql-bugs@postgresql.org>
Subject: Re: [OT] Microsoft: Kubernetes clusters hacked in malware campaign via PostgreSQL
Date: Tue, 10 Jan 2023 17:21:27 -0500
Message-ID: <379034.1673389287@sss.pgh.pa.us> (raw)
In-Reply-To: <CALT9ZEGsd9cP25=PrtVuOHNb4FAM4EJTiMNEr8jo7rUeV4fbTA@mail.gmail.com>
References: <CAH8yC8=oe+Pm+j0xz-4Hh_LYrRbZ92bq=iOa236bEV+68CgHsQ@mail.gmail.com>
	<CABUevEy=JV6ND-h38UNEnBG4zX=vGrWt1v-iF9q0PDh4FewCMw@mail.gmail.com>
	<CAH8yC8marSG+mhuKSFj01EFziZrQK4hGThx7dtE64y7SH5m2Qw@mail.gmail.com>
	<CALT9ZEGG6DPg=ahRSMBOEMg6OuRJx3Tsrfnw8DtVQ4HHybyWPQ@mail.gmail.com>
	<CABUevEzmWBcpMr_VLqUyWSsuGcOmYX9y+hCptu9aJ+VfN2Ccrg@mail.gmail.com>
	<CALT9ZEFN+jAbaLs12p-np8VXVMYswV7uU03xHjPXAZugaa1ehQ@mail.gmail.com>
	<CAH8yC8nwHw9CqBr+fPwRCB0UfArdOC7b6-tL1DYO1EsZ8MXLig@mail.gmail.com>
	<CABUevEzq6uv39wUyu=zBW6NezXvm25U3R4i9W5+_g28KWWqT7w@mail.gmail.com>
	<CAH8yC8kGR0YHoCZf2TXhxJS9-FDhPaMCpo89CCXn=kGtVbRn5Q@mail.gmail.com>
	<CALT9ZEGsd9cP25=PrtVuOHNb4FAM4EJTiMNEr8jo7rUeV4fbTA@mail.gmail.com>

Pavel Borisov <pashkin.elfe@gmail.com> writes:
> Regarding the fact that using weak passwords isn't limited, I think
> anyone can write an extension that limits (or advises against) weak
> passwords based on the author's definition of weakness, like checking
> by dictionary or so. That's the power of Postgres extensibility. I
> don't like an idea that Postgres core should enforce some arbitrary
> things like "weakness".

It's less easy than it sounds, actually, because current best practice
is that the server will never see the cleartext password at all, so
you can't apply the usual litany of weak-password checks.  About all
you can do is apply a brute force rainbow attack, which is far from
cheap (although I guess the DBA could run such checks in the background).
Even that might be rendered infeasible if the password is stored as
a SCRAM verifier; I'm not sure about that.  Anyway, this is why
contrib/passwordcheck is a development backwater rather than something
people actually use.

			regards, tom lane





view thread (14+ messages)  latest in thread

Message-ID: <379034.1673389287@sss.pgh.pa.us>
Permalink:  ../379034.1673389287@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/379034.1673389287@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, pashkin.elfe@gmail.com, magnus@hagander.net
  Subject: Re: [OT] Microsoft: Kubernetes clusters hacked in malware campaign via PostgreSQL
  In-Reply-To: <379034.1673389287@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox