SEO
vBulletin Search Engine Optimization
| |||||||
| Register | FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
04-24-2008, 06:15 PM
| ||||
| ||||
 pgadmin security issue Hi, (pgadmin 1.8.2 ) PROBLEM 1 Even though we can restrict a user for couple of databases , the user can disconnect from the current session and edit the connection properties SO this means he could remove the DB restriction field " datname IN ('live_db', 'test_db') " and reconnect and see all the other databases I recommend setting up a admin account at the time of installing pgadmin and only by login in to the admin account of pgadmin should be able to create, edit and view connection properties PROBLEM 2 When making a connection to the DB server with pgadmin if u use a valid db name and a valid user login name Then pgadmin will allow access to the database with out checking the password I mean if I type a wrong password BUT if the user account and the database is valid I will still be able to access the database I'm new to postgres so I'm not sure if this is a real bug or if this is a feature , Please update me ASAP Thanks Suren -- This message has been scanned for viruses and dangerous content by (RamaDBK) MailScanner, and is believed to be clean.      |
|
04-24-2008, 06:15 PM
| |||
| |||
| Re: pgadmin security issue Hi, Suren, > // > > */PROBLEM 1/* > > /Even though we can restrict a user for couple of databases , the user > can disconnect from the current session and edit the connection > properties/ > > /SO this means he could remove the /DB restriction field/ “ datname IN > ('live_db', 'test_db') “ and reconnect and see all the other databases/ > > / / > > /I recommend setting up a admin account at the time of installing > pgadmin and only by login in to the admin account of pgadmin should be > able to create, edit and view connection properties/ > I think its not pgAdmin you should set permitions on. You should not grant your user to connect to databases you don't want him to (in postgreSQL). > > // > > / / > > */PROBLEM 2/* > > /When making a connection to the DB server with pgadmin if u use a > valid db name and a valid user login name/ > > /Then pgadmin will allow access to the database with out checking the > password/ > > /I mean if I type a wrong password BUT if the user account and the > database is valid I will still be able to access the database/ > > / / > > /I’m new to postgres so I’m not sure if this is a real bug or if this > is a feature , Please update me ASAP/ > > /Thanks/ > > /Suren/ > configure your postgresql. In file pg_hba.conf that you have "md5" identification method, not "trust". -- Julius Tuskenis -- Sent via pgadmin-support mailing list (pgadmin-support@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgadmin-support |
|
04-24-2008, 06:15 PM
| ||||
| ||||
| Re: pgadmin security issue On Wed, Apr 23, 2008 at 8:11 AM, Julius Tuskenis <julius@nsoft.lt> wrote: > Hi, Suren, > > > > > > /Even though we can restrict a user for couple of databases , the user can > disconnect from the current session and edit the connection properties/ > > > > /SO this means he could remove the /DB restriction field/ " datname IN > ('live_db', 'test_db') " and reconnect and see all the other databases/ > > > > > > /I recommend setting up a admin account at the time of installing pgadmin > and only by login in to the admin account of pgadmin should be able to > create, edit and view connection properties/ > > > > > I think its not pgAdmin you should set permitions on. You should not grant > your user to connect to databases you don't want him to (in postgreSQL). This is correct - the DB restriction option is not a security feature, but a convenience feature to allow you to hide databases in which you have no interest. This is most useful in schools or with hosting providers where there may be large numbers of databases on the same server, most of which are of no interest to an individual user. As Julius correctly states, to *secure* databases, you must revoke connect privileges on the server. -- Dave Page EnterpriseDB UK: http://www.enterprisedb.com -- Sent via pgadmin-support mailing list (pgadmin-support@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgadmin-support |
Linear Mode
