I can access postgres database on Rails even with a wrong password

Question

I'm able to connect to my local Postgres database, even with a wrong password. Here is how I created a role and a database (I'm on Mac OSX with Postgres 9.3):

psql postgres

CREATE ROLE role_name WITH ENCRYPTED PASSWORD 'role_password' NOSUPERUSER NOCREATEROLE NOCREATEDB LOGIN;

CREATE DATABASE db_name OWNER role_name;

\q

So, when I configure my database.yml file on Rails, using the following:

default: &default
  adapter: postgresql
  encoding: unicode
  pool: 5

development:
  <<: *default
  database: db_name
  username: role_name
  password: this_is_a_wrong_password_ha_ha

and starting the server (rails s), everything works fine: I can create tables with migrations and create/read/update/delete data in it.

I can even do that without giving a role and/or a password.

How can I block access to a database if the role name and role password are not correct? Where I'm wrong? Thanks

Maxim · Accepted Answer · 2015-03-02 16:16:21Z

1

Seems like this is default settings for your /usr/local/var/postgres/pg_hba.conf. It is allow access to DB for any local connections:

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# "local" is for Unix domain socket connections only
local   all             all                                     trust
# IPv4 local connections:
host    all             all             127.0.0.1/32            trust
# IPv6 local connections:
host    all             all             ::1/128                 trust

answered Mar 2, 2015 at 16:16

Maxim

10k6 gold badges67 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Hassen Over a year ago

Yes @maxd, you're right. my pg_hba.conf is identical to your answer. How can I prevent this? (I mean only a particular user for a particular database)

Maxim Over a year ago

Just adjust this config and restart Postgres.

Frank Heikens Over a year ago

reload is good enough, you don't have to restart the database for this type of change.

Collectives™ on Stack Overflow

I can access postgres database on Rails even with a wrong password

1 Answer 1

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Related