even with a password set, one can connect without (this is a major security issue?)

[craff]

in docker-entrypoint.sh there is line 252:
``̀`
printf 'host all all all %s\n' "$POSTGRES_HOST_AUTH_METHOD"
} >> "$PGDATA/pg_hba.conf"

That keeps trust! shoud be:

printf 'local all all %s\n' "$POSTGRES_HOST_AUTH_METHOD"
    printf 'host all all all %s\n' "$POSTGRES_HOST_AUTH_METHOD"
} > "$PGDATA/pg_hba.conf"

I can confirm that it works and am submitting a PR.

[tianon]

This is intentionally keeping the PostgreSQL upstream default, which only allows unauthenticated connections locally, and can be modified/disabled via other means (and has been discussed in issues in this repository several times previously).

[craff]

There are "host" allowed with trust: it is not only local connection. If a user listen all adresses, one can connect from anywhere without password and there is no way to change that apart changing the docket-entrypoint.sh. Le 29 décembre 2022 06:04:40 GMT-10:00, Tianon Gravi ***@***.***> a écrit :

…

This is intentionally keeping the PostgreSQL upstream default, which only allows unauthenticated connections locally, and can be modified/disabled via other means (and has been discussed in issues in this repository several times previously). -- Reply to this email directly or view it on GitHub: #1028 (comment) You are receiving this because you authored the thread. Message ID: ***@***.***>

[yosifkit]

None of the PostgreSQL-provided default host entries in pg_hba.conf allow any remote access. They are all limited to localhost-only IP ranges that are not routable across a network, so none of them are exploitable even if the container is run with host mode networking (--network host).

$ docker run -it --rm -e POSTGRES_PASSWORD="password" --name=pg postgres

$ docker exec -it pg bash
root@ea22e289a6d0:/# grep -vE '^[#]|^\s*$' /var/lib/postgresql/data/pg_hba.conf
local   all             all                                     trust
host    all             all             127.0.0.1/32            trust
host    all             all             ::1/128                 trust
local   replication     all                                     trust
host    replication     all             127.0.0.1/32            trust
host    replication     all             ::1/128                 trust
host all all all scram-sha-256
$ # ^ this last one is the one the entrypoint script adds

Without --network=host, these passwordless trust connections can only happen from within the container (like docker exec). If your situation requires them to be different, the file can be controlled via POSTGRES_INITDB_ARGS='--auth-local=scram-sha-256 --auth-host=scram-sha-256' to control the local connection initial default and the host connection initial default values in pg_hba.conf.

$ docker run -it --rm -e POSTGRES_PASSWORD="password" -e POSTGRES_INITDB_ARGS='--auth-local=scram-sha-256 --auth-host=md5' --name=pg --network=host postgres
...
$ docker exec -it pg bash
root@barad-dur:/# grep -vE '^[#]|^\s*$' /var/lib/postgresql/data/pg_hba.conf
local   all             all                                     scram-sha-256
host    all             all             127.0.0.1/32            md5
host    all             all             ::1/128                 md5
local   replication     all                                     scram-sha-256
host    replication     all             127.0.0.1/32            md5
host    replication     all             ::1/128                 md5
host all all all scram-sha-256

There is a table I made over in #897 (comment) that shows how POSTGRES_INITDB_ARGS="=-auth-host=scram-sha-256", POSTGRES_HOST_AUTH_METHOD=authValue, and -c password_encryption=encValue interact though I am not certain how those also interact with --auth-local in initdb args.