On 1/1/23 14:48, Adrian Klaver wrote:
> On 1/1/23 13:11, Antonis Christodoulou wrote:
>> Hello Adrian,
>>
>> No it’s not open, but the database itself has very simple credentials
>> (I am just starting with PostgreSQL). What’s weird about the logs?
>
> Not the logs the ps output. I would expect to see something like:
>
> ps -ef | grep postgres
> postgres 395382 1 0 2022 ? 00:03:31
> /usr/lib/postgresql/14/bin/postgres -D /var/lib/postgresql/14/main -c
> config_file=/etc/postgresql/14/main/postgresql.conf
> postgres 395384 395382 0 2022 ? 00:00:01 postgres: 14/main:
> checkpointer
> postgres 395385 395382 0 2022 ? 00:00:26 postgres: 14/main:
> background writer
> postgres 395386 395382 0 2022 ? 00:00:26 postgres: 14/main:
> walwriter
> postgres 395387 395382 0 2022 ? 00:01:45 postgres: 14/main:
> autovacuum launcher
> postgres 395388 395382 0 2022 ? 00:00:05 postgres: 14/main:
> archiver last was 0000000100000003000000B9.00000028.backup
> postgres 395389 395382 0 2022 ? 00:01:37 postgres: 14/main:
> stats collector
> postgres 395390 395382 0 2022 ? 00:02:24 postgres: 14/main:
> pg_cron launcher
> postgres 395391 395382 0 2022 ? 00:00:01 postgres: 14/main:
> logical replication launcher
>
> This:
>
> postgres 3342383 1 0 2022 ? 00:00:00 FzXlkULu
> postgres 3344758 1 99 2022 ? 3-14:39:11 OElid7Dp
> postgres 3419125 1 18 13:57 ? 01:17:03 tracepath
>
> just does not look right.
>
>
At the very least disconnect that machine from the internet. Completely.