Re: [tlug] CentOS using default/blank? password postgres

[Christian Horn <chorn@example.com>]

On Thu, Aug 21, 2008 at 03:24:20PM +0900, Hung Nguyen Vu wrote:
> 
> My friend's CentOS 5.2 got hit by a scan and the bad guy was in.
> 
> postgres pts/1        Wed Aug 20 08:45 - 08:54  (00:08)
> host20-31-dynamic.52-82-r.retail.telecomitalia.it
> postgres pts/1        Wed Aug 20 08:17 - 08:40  (00:23)     121.14.139.26
> 
> I am not sure if CentOS mentions this issue at any point but at least,
> during the installation of postgres,
> he was not informed that he had to change the password of  user postgres.

At least the upstream from redhat has no linux-password set for user
postgres by default:

# grep postgre /etc/shadow
postgres:!!:14098::::::
# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 5.2 (Tikanga)

Wondering what could drive centos-people to set a password..


Christian