Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [postgresql]

PostgreSQL is an open-source RDBMS.

0
votes
1answer
42 views

How secure is pgAdmin to save database password?

When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the ...
2
votes
1answer
234 views

Thousands of 28000 “no pg_hba.conf entry for host” logs from Postgres - is this an attack?

Since yesterday afternoon my production Postgres database hosted on Amazon EC2 has been logging thousands of errors (averaging one or two per second) that all follow the format: sql_error_code = ...
2
votes
1answer
214 views

SQL injection on PostgreSQL in integer field?

I was trying https://server/shared/sendemail?sendto=" and got this response: Database operation "0or1row" failed (exception ERROR, "ERROR: invalid input syntax for integer:""" LINE 4: where user_id ...
1
vote
0answers
55 views

HIPAA compliant BI reporting tool?

We are building an application for healthcare industry and we are planning to use a 3rd party BI tool for reporting which will directly connect to our postgres DB and generate the desired reports ...
1
vote
0answers
61 views

I had a (password protected) postgres docker container running on a public port for a few minutes [closed]

Could the server be compromised? I've deleted the container.
2
votes
1answer
141 views

How to understand how someone had ssh access, and how to remove CVE-2017-0358

I have a home server that was compromised recently, it has been used to mine some crypto currencies. I have not stopped anything yet apart from locking ssh to my user only. The processes are still ...
1
vote
3answers
185 views

How strong should a database password be?

Seems like a trivial question, but I couldn't find other questions that address the following. So I'm simply asking, how strong would my (super user) database credentials ideally be? I simply figured ...
1
vote
1answer
124 views

Public guest user for PostgreSQL?

I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest ...
70
votes
3answers
13k views

Is this a SQL injection attack or is it some sort of bug?

I was looking through some data in our database when I came across a bunch of weird user_id entries: user_id -1080) ORDER BY 1# -1149 UNION ALL SELECT 79,79,79,79,79,79,79,79,79# -1359' UNION ALL ...
0
votes
1answer
67 views

Is sharing databases's hostname considered to be a security hole?

We have a Postgres database running on a Heroku and want to setup an external connection to it from the DB management GUI application (e.g. pgAdmin) Being novice to security things I wonder if it is ...
3
votes
2answers
4k views

Postgres protection from SQL Injection

Postgres allows dynamic code execution, which might leave it vulnerable to SQL injection. What protective measures does it have against this?
7
votes
2answers
1k views

Postgres password security

How safe is a Postgres user's password? When a new db user is created, is the stored password hashed and salted?
-3
votes
2answers
1k views

What logs to look for on Ubuntu when Postgres DB is hacked! [closed]

Updated the question title to clarify that this post is not asking the community to answer "how we got hacked" but "what logs to look for or pointers that may help our investigation". We feel that ...
1
vote
1answer
444 views

Heroku postgres: potential brute force attack

I have a Django app running on Heroku using Heroku Postgres. I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database ...
0
votes
1answer
123 views

Allowing customer to generate a secret key for securing RDS instance on AWS

I have an microservice architecture running on AWS ECS cluster using Postgres and Node and there is this requirement that we need to somehow allow our client to lock our database with a secret key ...
3
votes
1answer
128 views

Ciphertext vs database level encryption

For data that must be encrypted (read again, not hashed like a password) does storing ciphertext in a database gain you much over using the database's built-in encryption? In this case it would be ...
2
votes
1answer
218 views

How many combinations of md5sums can be computed from a call to random() in PostgreSQL?

Problem space I'm way out of my pay grade, I'm trying to figure out How much randomness does a call to random() actually provide in PostgreSQL? SELECT random(); Whether or not you can reasonably ...
1
vote
3answers
2k views

Metasploit Search Multiple Keywords

I am having an issue with Metasploit's search commands. When trying to search multiple keywords, the output displays only the first keyword. For example, if I use the command search platform:windows ...
5
votes
1answer
107 views

Restoring database from a hacked system

A linux VM with postgres 9.4 was hacked into. (Two processes taking 100% cpu, weird files in /tmp, did not reoccur after kill(s) and restart.) It was decided to install the system from scratch on a ...
1
vote
2answers
457 views

Is it bad to give www-data user access to Postgres client certificate?

I have a first server running a Postgres database. I have allowed remote access to this database, using certificates for authentification (following this tutorial). Now I have a second server running ...
2
votes
4answers
911 views

Can TLS be a secure alternative to VPN?

I am developing an application that will be run by untrusted users in high performance computing centers. My users will not have root access, therefore VPN is not an option. I need some way to ...
0
votes
2answers
209 views

Is there a way to specify PHP escape method when using SQLmap?

I'm helping a collegue of mine to test if his website is completely SQLi-proof. It looks promising, but i'm trying to make sure, and by chance I know he's using pg_escape_string to sanitize his POST ...
1
vote
0answers
354 views

Can you use null byte injection to exploit SQLi in Postgres?

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields. <h4>...
2
votes
1answer
262 views

In postgres LDAP authentication, are passwords encrypted?

I am wondering if postgres LDAP login is secure? Would passwords be transmitted in clear text potentially if this is not set up properly?
16
votes
1answer
3k views

Is Postgres's uuid_generate_v4 securely random?

I'm using Postgres's uuid_generate_v4 in a uuid primary key column to generate secure one-time authentication tokens. Is this okay? Does Postgres use a secure random number source for generating these ...
1
vote
0answers
868 views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
18
votes
3answers
7k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
19
votes
4answers
3k views

Do stored procedures prevent SQL Injection in PostgreSQL?

Is it true that stored procedures will prevent databases from being injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injections if we only ...