4 ms·
Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it ha
by kerng 8y ago
Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly.
That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road.
But from a pure argument standpoint Postgres is correct, it's more of a defense in depth strategy.
- jarfil 8y agoIf I understand it correctly, the feature is controlled via a user permission which is not granted by default.
- kerng 8y agoIf that is correct, then it's really a non issue I'd say.
- michelpp 8y agoQuoting Andreas Freund from the mailing list: """ Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a privileged account. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql-server-2017 https://docs.microsoft.com/en-us/sql/database-engine/configu... and it allows to execute shell code (as a specified user) even when not a sysadmin: https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-2017#xp_cmdshell-proxy-account https://docs.microsoft.com/en-us/sql/relational-databases/sy... """ so no MS didn't really "lock down" the feature.
- deleted 8y ago[deleted]
- hobs 8y agoIf you make a proxy account, AS AN ADMIN. I have personally walked dozens of DBAs through making said proxy account as it was non-trivial to accomplish. Please stop repeating this FUD.
- michelpp 8y agoYou cannot run COPY...PROGRAM without a permission that can only be granted to you by a superuser and which is not granted by default. I'm failing to see the distinction. Postgres is just a process that happens to do a lot of I/O. It's no different than any other Unix process: it can spawn children, it can dynamically load libraries on request. It protects these powerful tools with permissions, which is the sane and correct approach taken by many, many other languages and frameworks, all just unix processes, all just trying to get shit done.
- hopler 8y agosudo exists, even though an admin could just log in as root all the time, because it's safer to keep your gun unloaded when you aren't planning to use it immediately. Keeping your gun loaded isn't a security flaw, but it is dangerous.
- michelpp 8y agosudo requires being granted permission. If you have it, you can run code as root. It is not granted by default. COPY...PROGRAM requires being granted permission. If you you have it you can run code as the postgres user. It is not granted by default.
- anarazel 8y agoThe quote's from me, and even in the quoted part explicitly says "if you have a privileged account". And an admin user you just need to enable it, and it works without even the proxy user configured. Please explain what's FUD about that? The postgres equivalent this post is about a feature that's only granted to superusers (or in recent version user that have explicitly been granted rights that are equivalent to superuser and documented as such - namely the right to directly write into any database file...).
- userbinator 8y agoit's more of a defense in depth strategy If you take that to its logical conclusion you end up with completely unusable, user-hostile software that becomes nearly useless. The fact that everything can be abused, should not be a reason to ban everything either.
- kerng 8y agoIt's not about banning but secure by default. A feature that a minority of users needs, shouldn't be accessible by default - it's common security principle. Someone above mentions that the feature/config is actually off by default!
- cestith 8y agoThank goodness it's not accessible by default.