Skip to main content

SEC.AUTH.HBA_TRUST — A network line that asks for no password

  • Category: security
  • Severity: critical
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about how the server authenticates, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: PostgreSQL 18

The line states that no credential is required​

trust is not a weak authentication method. It is the absence of one. PostgreSQL asks for nothing: whoever opens a TCP connection and names a role IS that role — no password, no certificate, no challenge. Every other control in the database sits behind this line, so a trust here makes the role grants, the row-level security policies and the audit trail decorative for anybody who can route to the port.

The address range decides how many people that is. all means everyone who can reach the host.

Bad​

# pg_hba.conf — any host on the network can be any role
host    all    all    0.0.0.0/0    trust

Good​

# a method that authenticates, and a range that is actually used
hostssl all    app    10.0.4.0/24  scram-sha-256

Reload with SELECT pg_reload_conf(); and confirm with:

SELECT rule_number, type, address, auth_method, error FROM pg_hba_file_rules ORDER BY rule_number;
  • SEC.AUTH.HBA_TRUST_LOCAL — the same method on a Unix socket, which is a smaller finding for a real reason and therefore a separate rule.
  • SEC.AUTH.HBA_OPEN_CIDR — how wide the line is. Fix this one first: a narrow trust line is still no authentication.