1 Topic by mario36

  • mario36
  • Member
  • Offline
  • Registered: 2025-05-06
  • Posts: 3

Topic: IREDmail not have passwordl for DB (mysql, postgres) by default

mysql -u username
su - postgres

Is security risk?
if i add password is not broken mail server work?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by coralsnake

  • coralsnake
  • Member
  • Offline
  • Registered: 2021-09-20
  • Posts: 7

Re: IREDmail not have passwordl for DB (mysql, postgres) by default

Why can "su - postgres" be executed without a password?

  • if it runs as user root or with sudo, as they have full system access anyway

Is it a security flaw?

  • Not a flaw if root/sudo access is well-secured and PostgreSQL has strong authentication

Who can execute "su"?

  • su can only be executed by the root user or members of the sudoers file (with sudo privileges). Without these permissions, su requires a password or fails, as regular users lack authority to switch to other users (like postgres).