Skip to main content

SEC.AUTH.HBA_TRUST_LOCAL — Unix-socket connections without authentication

  • Category: security
  • Severity: medium
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about how the server authenticates, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: PostgreSQL 18

Being on the host should not mean being every role​

local lines govern the Unix-domain socket. Reaching it already requires being on the machine, which is why this is medium rather than critical — but it is not nothing: any process on the host that can open the socket connects as any role it names, including roles it was never granted. A cron job, a sidecar, a compromised worker, a developer shell.

Bad​

local   all    all    trust

Good​

# the operator account authenticates as the OS user it already is
local   all    postgres    peer

# the application presents a password like any other client
local   all    app         scram-sha-256

peer compares the connecting OS user against the database role name, so it authenticates without a password and without trusting everybody.

  • SEC.AUTH.HBA_TRUST — the same method on a network line, where the blast radius is everyone who can route to the port.