TMA-POSTGRES-4.3
Ensure excessive administrative privileges are revoked
Opis
With respect to PostgreSQL administrative SQL commands, only superusers should have elevated privileges. PostgreSQL regular, or application, users should not possess the ability to create roles, create new databases, manage replication, or perform any other action deemed privileged.
Kako se proverava
Metod provere: Ručni pregled
Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.
Run psql -c "\du+" and review role attributes (Superuser, Create role, Create DB, Replication, Bypass RLS). Only designated administrative roles may hold them; any regular role with administrative attributes is a fail.
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Revoke unneeded attributes, e.g. ALTER ROLE <role> NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- postgresdatabaseauthorizationmanual
- Referenca
- CIS PostgreSQL 18 Benchmark v1.0.0 - 4.3 Ensure excessive administrative privileges are revoked