TMA-POSTGRES-4.4
Lock Out Accounts if Not Currently in Use
SedangLevel 1Tinjauan manualpostgres
Deskripsi
If users with database accounts will not be using the database for some time, disabling the account will reduce the risk of attacks or inappropriate account usage.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Run SELECT rolname FROM pg_catalog.pg_roles WHERE rolname !~ '^pg_' AND rolcanlogin; and compare with the accounts currently in use. Inactive accounts must not appear in the output.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Lock unused accounts with ALTER ROLE <role> NOLOGIN; (re-enable with LOGIN when needed) or drop them.
Properti
- Sistem operasi
- Apa saja
- Tag
- postgresdatabaseauthenticationmanual
- Referensi
- CIS PostgreSQL 18 Benchmark v1.0.0 - 4.4 Lock Out Accounts if Not Currently in Use