Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

HighLevel 1Automatedpostgres

Description

Transport Layer Security (TLS), and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols which can be used to encrypt data sent between client and server. Passes for TLSv1.2 or TLSv1.3 (preferred). Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

How it is checked

Audit method: SQL query

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN current_setting('ssl_min_protocol_version') IN ('TLSv1.2','TLSv1.3') THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Expected output: compliant

How it is fixed

Fix method: SQL statement

shell

psql -X -U "${PGUSER:-postgres}" -c "ALTER SYSTEM SET ssl_min_protocol_version = 'TLSv1.3'" -c "SELECT pg_reload_conf()"

Properties

Operating systems: Any
Tags: postgresdatabasetls
Reference: CIS PostgreSQL 18 Benchmark v1.0.0 - 6.9 Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target postgres