Looked at /etc/shadow, and (in fact) it doesn't have a password, so I was wrong about that. Tried to use the login command to login directly log into postgres, but for some reason could not do that on RHEL 4.0 either. So, like you said, I am not certain that I have a vulnerability here at all, other than su-ing from root. -----Original Message----- From: Tom Lane [mailto:tgl@xxxxxxxxxxxxx] Sent: Friday, September 22, 2006 3:08 PM To: Lane Van Ingen Cc: pgsql-admin@xxxxxxxxxxxxxx Subject: Re: [ADMIN] Security Concerns over User 'postgres' "Lane Van Ingen" <lvaningen@xxxxxxxxx> writes: > We created our PostgreSQL instance by compiling it from source, and the > instance is working just fine. User postgres runs the service; we do not > know what the password is, and we think it got created automatically by the > compile / install process. Are you sure it even *has* a password? In the default RPM installation, user postgres is created without any password --- the only way to become postgres is to su there from root, and if you've got root you hardly need to crack into postgres. regards, tom lane
