0

I have a postgres 12.
I've set the password for user postgres as password and somehow after some time my application gets authentication failed for user "postgres".
Then I login with psql and change the password with ALTER USER ... command. And then the cycle repeats itself.

I checked the table pg_user and there is null value on valuntil column.

Dennis Gloss
  • 2,307
  • 4
  • 21
  • 27

2 Answers2

2

I just ran into this same issue with the postgres user and a created user. After doing some testing I found out that by default postgres and my created user did not have a password expiry set and the password appeared as though it was changing and cause me to not be able to log into either account even after an hour since the previous password change.

Solution: After changing the expiry value to a future date the issues stopped.

I'm using PostgreSQL 13.3 with Ubuntu 20.

Ryan Harris
  • 329
  • 2
  • 9
-2

PostgreSQL doesn't randomly change your password.

Someone else is logging in and changing your password. Since your password is about the worst possible password, this would not be hard to do for anyone who can reach your box and can get past pg_hba.conf. Depending on your firewall and your pg_hba.conf, this could be anyone with internet access. Which is a lot of people.

Your quoted error message is incomplete. Did the message start with "password" which you stripped off? You can look in the server side log file to get more details on the failure than are sent to the unauthenticated client. For example:

FATAL:  password authentication failed for user "postgres" 
DETAIL:  User "postgres" has no password assigned.


FATAL:  password authentication failed for user "jjanes" 
DETAIL:  Password does not match for user "jjanes".
jjanes
  • 37,812
  • 5
  • 27
  • 34
  • Thanks for response. But the port 5432 is not open in firewall. And I'm the only user who has access to the machine... – Dennis Gloss Apr 10 '20 at 08:54
  • I would double and triple check both of those things. Can you set up an external box (say, on AWS) and use that to verify it can't get through? Maybe you have a "friend" who is playing you for laughs? – jjanes Apr 10 '20 at 13:28