PostgreSQL
TMA-POSTGRES-4.4
Lock Out Accounts if Not Currently in Use
MediumLevel 1Manual reviewpostgres
Description
If users with database accounts will not be using the database for some time, disabling the account will reduce the risk of attacks or inappropriate account usage.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Run SELECT rolname FROM pg_catalog.pg_roles WHERE rolname !~ '^pg_' AND rolcanlogin; and compare with the accounts currently in use. Inactive accounts must not appear in the output.
How it is fixed
Fix method: Guidance or infrastructure patch
Lock unused accounts with ALTER ROLE <role> NOLOGIN; (re-enable with LOGIN when needed) or drop them.
Properties
- Operating systems
- Any
- Tags
- postgresdatabaseauthenticationmanual
- Reference
- CIS PostgreSQL 18 Benchmark v1.0.0 - 4.4 Lock Out Accounts if Not Currently in Use