Preventing Server Spoofing

PostgreSQL 8.4.22 Documentation
Prev | Fast Backward | Chapter 17. Server Setup and Operation | Fast Forward | Next

# 17.6. Preventing Server Spoofing

While the server is running, it is not possible for a malicious user to take the place of the normal database server. However, when the server is down it is possible for a local user to spoof the normal server by starting their own server. The spoof server could read passwords and queries sent by clients, but could not return any data because the `PGDATA` directory would still be secure because of directory permissions. Spoofing is possible because any user can start a database server; a client cannot identify an invalid server unless it is specially configured.

The simplest way to prevent invalid servers for `local` connections is to use a Unix domain socket directory (unix_socket_directory) that has write permission only for a trusted local user. This prevents a malicious user from creating their own socket file in that directory. If you are concerned that some applications might still reference `/tmp` for the socket file and hence be vulnerable to spoofing, during operating system startup create symbolic link `/tmp/.s.PGSQL.5432` that points to the relocated socket file. You also might need to modify your `/tmp` cleanup script to preserve the symbolic link.

For TCP connections the server must accept only `hostssl` connections (Section 19.1) and have SSL `server.key` (key) and `server.crt` (certificate) files (Section 17.8). The TCP client must connect using `sslmode='verify-ca'` or `'verify-full'` and have the required certificate files present (Section 30.1).

Prev | Home | Next
Shutting Down the Server | Up | Encryption Options