PostgreSQL – Should Privileged Ports Be Used in Production?

linuxpostgresql

I've never found a recommendation to run Postgresql on a privileged port in production. What type of port should be used in production regarding security and best practices?

Best Answer

Running PostgreSQL under 1024 requires some hacking. It's almost impossible outside of win32. From the backend/main/main.c,

"root" execution of the PostgreSQL server is not permitted. The server must be started under an unprivileged user ID to prevent possible system security compromise. See the documentation for more information on how to properly start the server.

After which the backend calls exit(1). It also doesn't run as a setuid script. From the source,

Also make sure that real and effective uids are the same. Executing as a setuid program from a root shell is a security hole, since on many platforms a nefarious subroutine could setuid back to root if real uid is root. (Since nobody actually uses postgres as a setuid program, trying to actively fix this situation seems more trouble than it's worth; we'll just expend the effort to check for it.)

The only way to even set this up on Linux that I know of is

However, if you are worried about server spoofing (another server taking over the non-privilege connection before the PG executable) you can still be secure if you take some pre-cautions, as explained in Preventing Server Spoofing:

  • Local connection: use a Unix domain socket directory (unix_socket_directories) that has write permission only for a trusted local user.
  • Local connection: use requirepeer to specify the required owner of the server process connected to the socket.
  • TCP connection: the best solution is to use SSL certificates and make sure that clients check the server's certificate.