In this lesson, you will learn how to restrict access to PostgreSQL configuration files to prevent unauthorized modifications that could compromise your database's security posture.
When we talk about hardening PostgreSQL, we often focus on roles or SSL, but the integrity of your server starts at the file system level. PostgreSQL relies on two primary configuration files: postgresql.conf (runtime parameters) and pg_hba.conf (client authentication). If an attacker or a compromised service account gains write access to these files, they could disable SSL, bypass authentication, or even enable features that allow arbitrary code execution.
Restricting File Permissions
The golden rule is that only the user running the PostgreSQL process (typically the postgres user) should have read and write access. Any other user—or worse, a group—should be blocked.
On a Linux system, you should ensure the permissions are set to 0600 (read/write for owner only). You can apply this hardening with the following commands:
# Navigate to the data directory
cd /var/lib/postgresql/data
# Restrict permissions for configuration files
chmod 0600 postgresql.conf
chmod 0600 pg_hba.conf
# Ensure the owner is the postgres service account
chown postgres:postgres postgresql.conf
chown postgres:postgres pg_hba.conf
Why this matters for the Internals
Beyond permissions, you should avoid storing sensitive information like clear-text passwords directly in postgresql.conf. While some parameters (like ssl_key_file paths) must point to files, you should ensure those underlying key files also follow the 0600 permission rule.
Furthermore, consider moving sensitive files outside of the standard data directory if your threat model requires it, ensuring that the database process maintains ownership. By enforcing strict file system permissions, you create a "defense-in-depth" layer that prevents an attacker who has gained low-privileged shell access from escalating their privileges by manipulating how the database starts or who it trusts. Always verify these settings after every system update or maintenance window, as automation scripts can sometimes inadvertently revert permissions to more permissive states.
Key Takeaway: Harden your database security by setting file permissions on postgresql.conf and pg_hba.conf to 0600, ensuring only the PostgreSQL service account can read or modify its own configuration.