reinitialized.net/infrastructure
2
0
Fork 0
Code Issues 37 Pull requests Projects Releases Packages Wiki Activity Actions

[HIGH] POSTGRES_HOST_AUTH_METHOD set to 'trust' in Hudu config #16

New issue
Open
opened 2026-05-05 15:44:08 -05:00 by pjennings · 0 comments
pjennings commented 2026-05-05 15:44:08 -05:00
Owner
Copy link

Labels: area:security, area:containers, priority:high, type:bug

Description

In modules/secrets.example/apps1.nix line 47:
POSTGRES_HOST_AUTH_METHOD = 'trust'

This PostgreSQL authentication method allows ALL connections without password verification.

Impact

Any host that can reach the PostgreSQL port can connect to the Hudu database without credentials.

Recommended Fix

  1. Remove POSTGRES_HOST_AUTH_METHOD = 'trust'
  2. Set a strong password for the Hudu database user
  3. Use scram-sha-256 for strong password hashing
**Labels:** area:security, area:containers, priority:high, type:bug ## Description In modules/secrets.example/apps1.nix line 47: POSTGRES_HOST_AUTH_METHOD = 'trust' This PostgreSQL authentication method allows ALL connections without password verification. ## Impact Any host that can reach the PostgreSQL port can connect to the Hudu database without credentials. ## Recommended Fix 1. Remove POSTGRES_HOST_AUTH_METHOD = 'trust' 2. Set a strong password for the Hudu database user 3. Use scram-sha-256 for strong password hashing
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
indev
No results found.
Labels
Clear labels   
area:documentation

Documentation, inventory, runbooks

  
area:infrastructure

Infrastructure services and hardware

  
area:network

Network, firewall, and connectivity

  
area:security

Security vulnerabilities and findings

  
priority:critical

Fix immediately — active risk

  
priority:high

Fix within 1-2 weeks

  
priority:low

Backlog — hardening and best practices

  
priority:medium

Fix within 1 month

  
status:blocked

Blocked on dependency or decision

  
type:bug

Misconfiguration or broken behavior

  
type:deployment

New service or system deployment

  
type:enhancement

Improvement or hardening

  
type:investigation

Needs research or identification

No labels
area:documentation
area:infrastructure
area:network
area:security
priority:critical
priority:high
priority:low
priority:medium
status:blocked
type:bug
type:deployment
type:enhancement
type:investigation
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
reinitialized.net/infrastructure#16
No description provided.