PostgreSQL
TMA-POSTGRES-4.3
Ensure excessive administrative privileges are revoked
TinggiLevel 1Tinjauan manualpostgres
Deskripsi
With respect to PostgreSQL administrative SQL commands, only superusers should have elevated privileges. PostgreSQL regular, or application, users should not possess the ability to create roles, create new databases, manage replication, or perform any other action deemed privileged.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Run psql -c "\du+" and review role attributes (Superuser, Create role, Create DB, Replication, Bypass RLS). Only designated administrative roles may hold them; any regular role with administrative attributes is a fail.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Revoke unneeded attributes, e.g. ALTER ROLE <role> NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;
Properti
- Sistem operasi
- Apa saja
- Tag
- postgresdatabaseauthorizationmanual
- Referensi
- CIS PostgreSQL 18 Benchmark v1.0.0 - 4.3 Ensure excessive administrative privileges are revoked