PostgreSQL® Notes

Suggestions to enhance the security (only for advanced users)

• It is a good practice to create a white list for the hosts that are allowed to access the database in the file /db/wincc_oa/localdb/postgresql/pgdata/pg_hba.conf
• Restrict the permitted addresses for database communication with the setting listen_addresses in the file /db/wincc_oa/localdb/postgresql/pgdata/postgresql.conf. within the project directory.

Set the password for the default PostgreSQL® admin user

When a PostgreSQL® database managed by WinCC OA is created (see chapter Archive to Group Mapping), the default admin user postgres is deactivated and it is not possible to log into this WinCC OA managed database with this user.

However, if your security policy requires this user to have a strong password, perform the following steps to enforce a password for the PostgreSQL® user on:

Windows:

1. Start the WinCC OA project:

   cmd psql -U postgres -h %LOCALAPPDATA%\.winccoa -p 15432 winccoa

2. Reset the password: ALTER USER postgres WITH PASSWORD 'P@ssw0rd';
3. Edit the file:

   %proj_path%\db\wincc_oa\localdb\postgresql\16\pgdata\pg_hba.conf

4. Change the line:

   `local	all postgres trust`

   to

   `local	all postgres  scram-sha-256`

5. Query:

   select pg_reload_conf();

Linux

1. Start the WinCC OA project:

    cmd `psql -U postgres -h ~/.winccoa -p 15432 winccoa`

2. Query:

   ALTER USER postgres WITH PASSWORD 'P@ssw0rd';

3. Edit the file:

   `$proj_path$/db/wincc_oa/localdb/postgresql/16/pgdata/pg_hba.conf`

4. Change the line:

   `local	all postgres	trust`

   to

   `local	all postgres  scram-sha-256`

5. Query:

   select pg_reload_conf();