TMA-POSTGRES-6.9

Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

높음레벨 1자동postgres

설명

Transport Layer Security (TLS), and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols which can be used to encrypt data sent between client and server. Passes for TLSv1.2 or TLSv1.3 (preferred). Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN current_setting('ssl_min_protocol_version') IN ('TLSv1.2','TLSv1.3') THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: compliant

조치 방법

조치 방식: SQL 문

shell

psql -X -U "${PGUSER:-postgres}" -c "ALTER SYSTEM SET ssl_min_protocol_version = 'TLSv1.3'" -c "SELECT pg_reload_conf()"

속성

운영 체제: 모두
태그: postgresdatabasetls
참고 자료: CIS PostgreSQL 18 Benchmark v1.0.0 - 6.9 Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target postgres