4 ms·

Quoting Andreas Freund from the mailing list: """ Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a priv

Quoting Andreas Freund from the mailing list: """ Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a privileged account. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option?view=sql-server-2017 https://docs.microsoft.com/en-us/sql/database-engine/configu... and it allows to execute shell code (as a specified user) even when not a sysadmin: https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-2017#xp_cmdshell-proxy-account https://docs.microsoft.com/en-us/sql/relational-databases/sy... """ so no MS didn't really "lock down" the feature.

deleted 8y ago
[deleted]
hobs 8y ago
If you make a proxy account, AS AN ADMIN. I have personally walked dozens of DBAs through making said proxy account as it was non-trivial to accomplish. Please stop repeating this FUD.
- michelpp 8y ago
  You cannot run COPY...PROGRAM without a permission that can only be granted to you by a superuser and which is not granted by default. I'm failing to see the distinction. Postgres is just a process that happens to do a lot of I/O. It's no different than any other Unix process: it can spawn children, it can dynamically load libraries on request. It protects these powerful tools with permissions, which is the sane and correct approach taken by many, many other languages and frameworks, all just unix processes, all just trying to get shit done.
  - hopler 8y ago
    sudo exists, even though an admin could just log in as root all the time, because it's safer to keep your gun unloaded when you aren't planning to use it immediately. Keeping your gun loaded isn't a security flaw, but it is dangerous.
    - michelpp 8y ago
      sudo requires being granted permission. If you have it, you can run code as root. It is not granted by default. COPY...PROGRAM requires being granted permission. If you you have it you can run code as the postgres user. It is not granted by default.
- anarazel 8y ago
  The quote's from me, and even in the quoted part explicitly says "if you have a privileged account". And an admin user you just need to enable it, and it works without even the proxy user configured. Please explain what's FUD about that? The postgres equivalent this post is about a feature that's only granted to superusers (or in recent version user that have explicitly been granted rights that are equivalent to superuser and documented as such - namely the right to directly write into any database file...).
  - hobs 8y ago
    The FUD is someone saying Microsoft didnt lock down the xp_cmdshell functionality (which is the post I replied to.) I agree that the postgres and msft functionality effectively have the same level of permissions required, which is that an admin level user must take specific steps to allow this to occur.
    - anarazel 8y ago
      Well, the comment was in reply to somebody asking for the postgres feature to be locked down similar to MSSQL's - and I think the "FUD" spreading commenter just was trying to explain that it's already similarly locked down. Sure, it could have been a bit more explicit about that, but attacking that as FUD seems mighty strong.

deleted 8y ago

[deleted]

hobs 8y ago

If you make a proxy account, AS AN ADMIN. I have personally walked dozens of DBAs through making said proxy account as it was non-trivial to accomplish. Please stop repeating this FUD.

michelpp 8y ago
You cannot run COPY...PROGRAM without a permission that can only be granted to you by a superuser and which is not granted by default. I'm failing to see the distinction. Postgres is just a process that happens to do a lot of I/O. It's no different than any other Unix process: it can spawn children, it can dynamically load libraries on request. It protects these powerful tools with permissions, which is the sane and correct approach taken by many, many other languages and frameworks, all just unix processes, all just trying to get shit done.
- hopler 8y ago
  sudo exists, even though an admin could just log in as root all the time, because it's safer to keep your gun unloaded when you aren't planning to use it immediately. Keeping your gun loaded isn't a security flaw, but it is dangerous.
  - michelpp 8y ago
    sudo requires being granted permission. If you have it, you can run code as root. It is not granted by default. COPY...PROGRAM requires being granted permission. If you you have it you can run code as the postgres user. It is not granted by default.
anarazel 8y ago
The quote's from me, and even in the quoted part explicitly says "if you have a privileged account". And an admin user you just need to enable it, and it works without even the proxy user configured. Please explain what's FUD about that? The postgres equivalent this post is about a feature that's only granted to superusers (or in recent version user that have explicitly been granted rights that are equivalent to superuser and documented as such - namely the right to directly write into any database file...).
- hobs 8y ago
  The FUD is someone saying Microsoft didnt lock down the xp_cmdshell functionality (which is the post I replied to.) I agree that the postgres and msft functionality effectively have the same level of permissions required, which is that an admin level user must take specific steps to allow this to occur.
  - anarazel 8y ago
    Well, the comment was in reply to somebody asking for the postgres feature to be locked down similar to MSSQL's - and I think the "FUD" spreading commenter just was trying to explain that it's already similarly locked down. Sure, it could have been a bit more explicit about that, but attacking that as FUD seems mighty strong.