Configuration and Authentication
summary
Postgres supports many auth methods but the practical takeaways are concrete: never use trust or cleartext; prefer scram-256 (added in PG10) and require SSL with verify-full; client libraries must validate the SCRAM server proof to avoid man‑in‑the‑middle attacks; md5 hashes on disk enable pass‑the‑hash reuse so rotate and protect backups. PostgreSQL 16 adds pg_hba include files and regex/membership rules plus catalogs that record rule origins, making complex policies testable and debuggable.
AI-written summary · about
chapters (11)
- 0:00Intro
- 4:28Authentication methods
- 6:22Trust method
- 15:21SCRAM-SHA-256
- 18:12SCRAM security
- 21:19SCRAM Channel binding
- 24:49Client/server and HBA entries
- 30:57Regression tests
- 36:58About files included with @
- 44:44Inclusion depth
- 48:30System views
related talks
35mSecuring PostgreSQL From External Attack
48mAdvanced Authentication and Encrypted Connections
22mFrom trust to Tokens: A Short History of PostgreSQL Authentication
07mAll about Postgres security
32mEnhancing Security in PostgreSQL
50mSecuring PostgreSQL From External Attack
46mGet Your Insecure PostgreSQL Passwords to SCRAM!
50mSecuring PostgreSQL