0

I have a site that runs as a group of docker containers and one of them is a postgres database, and I have to admit I don't have much experience with these things. When I look at the logs I see what looks like multiple attempts at guessing my password:

 | 2020-11-17 15:08:33.958 UTC [25042] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:33.958 UTC [25042] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:34.567 UTC [25043] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:34.567 UTC [25043] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:35.183 UTC [25044] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:35.183 UTC [25044] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:35.797 UTC [25045] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:35.797 UTC [25045] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:36.417 UTC [25046] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:36.417 UTC [25046] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:37.038 UTC [25047] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:37.038 UTC [25047] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:37.660 UTC [25048] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:37.660 UTC [25048] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:38.268 UTC [25049] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:38.268 UTC [25049] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:38.895 UTC [25050] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:41.996 UTC [25056] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:42.612 UTC [25057] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:42.612 UTC [25057] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:43.226 UTC [25058] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:43.226 UTC [25058] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:43.838 UTC [25059] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:43.838 UTC [25059] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:44.455 UTC [25060] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:44.455 UTC [25060] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:45.074 UTC [25061] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:45.074 UTC [25061] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:45.682 UTC [25062] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:45.682 UTC [25062] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:46.311 UTC [25063] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:46.311 UTC [25063] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:46.937 UTC [25064] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:46.937 UTC [25064] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:47.554 UTC [25065] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:47.554 UTC [25065] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:48.175 UTC [25066] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:48.175 UTC [25066] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-17 15:08:48.791 UTC [25067] FATAL:  password authentication failed for user "postgres"
 | 2020-11-17 15:08:48.791 UTC [25067] DETAIL:  Role "postgres" does not exist.

 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-18 01:15:50.075 UTC [28278] FATAL:  password authentication failed for user "postgres"
 | 2020-11-18 01:15:50.075 UTC [28278] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-18 01:16:23.054 UTC [28280] FATAL:  password authentication failed for user "postgres"
 | 2020-11-18 01:16:23.054 UTC [28280] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-18 01:16:23.800 UTC [28281] FATAL:  password authentication failed for user "postgres"
 | 2020-11-18 01:16:23.800 UTC [28281] DETAIL:  Role "postgres" does not exist.
 |       Connection matched pg_hba.conf line 99: "host all all all md5"
 | 2020-11-18 03:24:13.696 UTC [28537] LOG:  could not receive data from client: Connection reset by peer
 | 2020-11-18 06:29:43.520 UTC [28910] FATAL:  unsupported frontend protocol 0.0: server supports 2.0 to 3.0
 | 2020-11-18 06:29:43.707 UTC [28911] FATAL:  unsupported frontend protocol 255.255: server supports 2.0 to 3.0
 | 2020-11-18 06:29:43.891 UTC [28912] FATAL:  no PostgreSQL user name specified in startup packet
 | 2020-11-18 11:38:43.544 UTC [29529] FATAL:  unsupported frontend protocol 65363.19778: server supports 2.0 to 3.0

And more lines like that. I am trying to understand what is happening here; I thought that only the following ports, which do not include the one for postgres, are open for my server:

# sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT       Anywhere
2375/tcp                   ALLOW       Anywhere
2376/tcp                   ALLOW       Anywhere
443                        ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
22/tcp (v6)                LIMIT       Anywhere (v6)
2375/tcp (v6)              ALLOW       Anywhere (v6)
2376/tcp (v6)              ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)

Also, nginx only handles 80 and 443:

server {

    listen 80;
...
server {
    listen 443 ssl;

But I am not an expert with server related configs, so I am probably missing something very obvious? Thanks for the time

UPDATE:

after reading the comments it looks like docker might be overriding the ufw fire wall rules above:

# iptables-save | grep 5432
-A POSTROUTING .... -p tcp -m tcp --dport 5432 -j MASQUERADE
-A DOCKER ! -i ... -p tcp -m tcp --dport 5432 -j DNAT --to-destination ...:5432
-A DOCKER -d ... -p tcp -m tcp --dport 5432 -j ACCEPT
Improve this question
6
  • The port for PostgreSQL, which is mostly likely 5432, is open on that particular container. What you need to check are the firewall rules assuming that one is even running.
    – Nasir Riley
    Nov 21, 2020 at 20:57
  • thanks @nasir, I just added info from the uwf status. Is that what you were talking about?
    – fersarr
    Nov 21, 2020 at 21:09
  • Is that the same container where PostgreSQL is running? What port is it listening on? You can see that in the config file.
    – Nasir Riley
    Nov 21, 2020 at 21:22
  • Your Postgres container is probably configured to expose the Postgres port. Doing that typically by-passes all other firewall rules on the host running the container. (Docker creates specific high priority iptables rules for exposed ports, that get applied before and are bypassing the ufw abstraction layer and therefore those rules won’t by displayed by ufw , you need to use native iptables commands such as iptables-save to see them)
    – Bob
    Nov 22, 2020 at 6:59
  • @Nasir the 'ufw status' was run on the linux host on which docker runs
    – fersarr
    Nov 22, 2020 at 12:45

1 Answer 1

Reset to default
0

The problem was that docker was creating iptables rules that were bypassing the firewall's (ufw) rules.

I fixed it by following this guide: https://devopsheaven.com/postgresql/docker/databases/security/ufw/iptables/2018/05/03/secure-postgres-docker-access.html

More related information here: https://github.com/moby/moby/issues/22054

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .