2

I have a Django app running on Heroku using Heroku Postgres.

I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database errors as shown below:

2017-02-25T20:31:18+00:00 app[postgres.346]: [DATABASE] [5-1] LOG:  could not accept SSL connection: EOF detected
2017-02-25T20:31:18+00:00 app[postgres.347]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "postgres", database "postgres", SSL off
2017-02-25T20:31:19+00:00 app[postgres.348]: [DATABASE] [5-1] LOG:  could not receive data from client: Connection reset by peer
2017-02-25T20:31:20+00:00 app[postgres.349]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "postgres", database "postgres", SSL off
2017-02-25T20:31:20+00:00 app[postgres.350]: [DATABASE] [5-1] FATAL:  password authentication failed for user "postgres"
2017-02-25T20:31:20+00:00 app[postgres.350]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:31:21+00:00 app[postgres.351]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "postgres", database "postgres", SSL off
2017-02-25T20:31:22+00:00 app[postgres.352]: [DATABASE] [5-1] FATAL:  password authentication failed for user "postgres"
2017-02-25T20:34:21+00:00 app[postgres.641]: [DATABASE] [5-1] FATAL:  password authentication failed for user "root"
2017-02-25T20:34:21+00:00 app[postgres.641]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:34:22+00:00 app[postgres.642]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "root", database "root", SSL off
2017-02-25T20:34:23+00:00 app[postgres.643]: [DATABASE] [5-1] FATAL:  password authentication failed for user "root"
2017-02-25T20:37:38+00:00 app[postgres.957]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "test", database "test", SSL off
2017-02-25T20:37:39+00:00 app[postgres.958]: [DATABASE] [5-1] FATAL:  password authentication failed for user "test"
2017-02-25T20:37:39+00:00 app[postgres.958]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:37:40+00:00 app[postgres.959]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "test", database "test", SSL off
2017-02-25T20:37:41+00:00 app[postgres.960]: [DATABASE] [5-1] FATAL:  password authentication failed for user "test"
2017-02-25T20:37:41+00:00 app[postgres.960]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:37:42+00:00 app[postgres.961]: [DATABASE] [5-1] FATAL:  no PostgreSQL user name specified in startup packet
2017-02-25T20:37:42+00:00 app[postgres.962]: [DATABASE] [5-1] FATAL:  no PostgreSQL user name specified in startup packet

This is only a small sample, there are about 800 such entries stretched across 6 minutes.

Now I have no idea what is causing this. I can't think of anything from my side that could have caused this so my best guess is it is some brute force attack to try to get into the database? Or what could be causing this?

Is this something to be concerned about and how can I stop this from happening again?

2

Almost certainly not. It's quite common to see automated attacks from web scanners - IPv4 is a pretty small address space and quite easy to enumerate (IPv6, at least, makes them work a bit to find targets!)

It's a low-cost, low-success, but potentially high-reward tactic if they stumble on a server with interesting data and a terrible (or default) password. Just make sure you have non-trivial passwords and you'll be fine.

3
  • Great, but you do think that it was some sort of attack? – Kritz Feb 27 '17 at 5:46
  • 1
    Yes, it's some sort of automated scan style attack. Nothing to worry about as long as you're using some basic security measures (such as non-trivial passwords, but other things too, like making sure the pg_hba.conf file has appropriate settings). – Jesse K Feb 27 '17 at 20:56
  • Thanks. Also, only SSL connections are allowed to the DB – Kritz Feb 28 '17 at 5:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.