PostgreSQL Security: Defending Against External Attacks
summary
Shows that search engines like shodan io, Censys and BinaryEdge find ~600,000 public Postgres instances and that a Hydra brute-force demo using a 1,000,000-password wordlist cracks a weak password (“hercules”) in seconds, while a simple connector flood exhausts connection pools for a DoS. Demonstrates pg_hba.conf trust spoofing via nmap/ip source, SSL/Wireshark MITM detection with cert validation, MD5 hash reversal using 100,000 common passwords vs SCRAM-SHA-256, readable raw data via pg_relation_filepath, and recommends VPN, updates, pgbouncer, encrypted backups and Transparent Data Encryption (CYBERTEC).
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:45How to identify Publicly available PostgreSQL deployments
- 4:11Penetration testing using Hydra
- 7:37Common vulnerabilities
- 9:41DOS attack
- 13:14“Trust” authentication in pg_hba.conf
- 16:58Enforcing SSL connections
- 19:05Using certificates
- 21:05SCRAM-SHA-256 for password security
- 26:27Data protection
- 28:05Transparent data encryption
related talks
35mSecuring PostgreSQL From External Attack
45mSecurity Attacks on PostgreSQL
22mPostgreSQL Threats and Attacks in the Wild
44mWho's managing the credentials for your database?
07mAll about Postgres security
50mSecuring PostgreSQL
28mFrom Dev to Prod: Securing Postgres the Right Way
54mConfiguration and Authentication