Securing PostgreSQL From External Attack
summary
Examines concrete external attack vectors and concrete defenses: default pg_hba often grants trust on local sockets, MD5 auth is legacy while SCRAM-SHA-256 is the current default (Postgres 14+), and SSL mode default prefer can silently fall back to unencrypted connections. Recommends certificate authentication or channel binding to prevent pass‑through/mitm, cites U2F hardware tokens and client certs for key rotation, and lists column encryption options (pgcrypto/pg_sodium), OS disk encryption, and vendor TDE solutions.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 3:11External attack vectors
- 7:09Authentication methods in PostgreSQL
- 12:29Password vulnerabilities and risks
- 16:22Man-in-the-middle attacks
- 19:17SSL and certificate authorities
- 23:50Channel binding and certificate auth
- 25:15Beyond connections: data theft
- 27:06Encryption at rest and volume encryption
- 32:45Q&A on password storage and security
related talks
50mSecuring PostgreSQL From External Attack
32mPostgreSQL Security: Defending Against External Attacks
07mAll about Postgres security
50mSecuring PostgreSQL
54mConfiguration and Authentication
45mSecurity Attacks on PostgreSQL
48mAdvanced Authentication and Encrypted Connections
22mFrom trust to Tokens: A Short History of PostgreSQL Authentication