Looked at /etc/shadow, and (in fact) it doesn't have a password, so I was
wrong about that.
Tried to use the login command to login directly log into postgres, but for
some reason could not do that on RHEL 4.0 either. So, like you said, I am
not certain that I have a vulnerability here at all, other than su-ing from
root.
-----Original Message-----
From: Tom Lane [mailto:tgl@sss.pgh.pa.us]
Sent: Friday, September 22, 2006 3:08 PM
To: Lane Van Ingen
Cc: pgsql-admin@postgresql.org
Subject: Re: [ADMIN] Security Concerns over User 'postgres'
"Lane Van Ingen" <lvaningen@esncc.com> writes:
> We created our PostgreSQL instance by compiling it from source, and the
> instance is working just fine. User postgres runs the service; we do not
> know what the password is, and we think it got created automatically by
the
> compile / install process.
Are you sure it even *has* a password? In the default RPM installation,
user postgres is created without any password --- the only way to become
postgres is to su there from root, and if you've got root you hardly
need to crack into postgres.
regards, tom lane