Ensure login via "local" UNIX Domain Socket is configured correctly

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review the 'local' lines of pg_hba.conf (SELECT * FROM pg_hba_file_rules WHERE type = 'local';). As user1 run psql -U postgres -d postgres: it must fail with 'Peer authentication failed'; as postgres it must succeed. Local login as another account than your own is a fail.

How it is fixed

Fix method: Guidance or infrastructure patch

Use 'local all all peer' (or 'local all postgres peer') as the local rule, create database roles that match OS users that need access, then SELECT pg_reload_conf();