On Mon, Jan 23, 2023 at 2:47 PM Robert Haas <robertmh...@gmail.com> wrote: > Second, the reason why I described it as a manufactured issue is > because it's a bit like asking someone to stand under a ladder and > then complaining when they get hit in the head by a falling object. > It's not that I think it's good for people to get a free exploit to > superuser, or to get hit in the head by falling objects. It's just > that you can't have the things that together lead to some outcome > without also getting the outcome.
I left out a sentence here. What I meant to say was we can't both allow passwordless loopback connections to the bootstrap superuser and also allow postgres_fdw to connect to anything that the user requests and then be surprised when that user can get into the superuser account. The natural outcome of combining those two things is that superuser gets hacked. The password requirement just *barely* prevents that attack from working, almost, maybe, while at the same time managing to block things that people want to do for totally legitimate reasons. But IMHO, the real problem is that combining those two things is extremely dangerous. -- Robert Haas EDB: http://www.enterprisedb.com
