2018-01-24 12:18 GMT+01:00 Condor <condor@stz-bg.com>:
> On 24-01-2018 12:52, Durumdara wrote:
>>
>> Hello!
>>
>> Somewhere the system administrator (who don't know the PG really)
>> installed a PGSQL server (10.x) with a database.
>> He couldn't manage the server well.
>>
>> Yesterday my colleague saw 21 databases in this server with random
>> names.
>>
>> He checked it with built in PGAdmin IV.
>> Today we checked it again, and we saw 33 databases.
>>
>> The first name is "ahucli" for example - like an aztec king... :-).
>>
>> The server OS is Windows, the PGSQL is 10.x.
>>
>> What can cause this strange thing?
>>
>> 1.) PGAdmin IV bug?
>> 2.) Their server is hacked/cracked from outside?
>> 3.) A wrong configured tool, or an automation?
>> 4.) "Alien invasion", etc.
>>
>> Did you see same thing anywhere?
>>
>> Thank you for any advice in this theme!
>>
>> Best regards
>> dd
>
>
>
>
> I bet on 2.
> probably did not setup pg_hba.conf file.
>
> Regards,
> HC
>
The logs are your friends.
Maybe you can track down those "CREATE DATABASE" commands with
timestamps and IP addresses.
There could be a (local rogue) piece of software that does this trick.
Again, check with logs.
--
Vincenzo Romano - NotOrAnd.IT
Information Technologies
--
NON QVIETIS MARIBVS NAVTA PERITVS
