PostgreSQL pg_hba.conf Trust Auth Backdoor Enabling Passwordless Logins

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•2

This rule monitors for modifications to the PostgreSQL configuration file 'pg_hba.conf', specifically looking for changes that would enable 'trust' authentication, followed by successful database logins using that method within one hour. This behavior is indicative of an attacker modifying authentication rules to gain unauthorized, passwordless access to a database.