TMA-POSTGRES-6.9

Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

VisokaNivo 1Automatskapostgres

Opis

Transport Layer Security (TLS), and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols which can be used to encrypt data sent between client and server. Passes for TLSv1.2 or TLSv1.3 (preferred). Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

Kako se proverava

Metod provere: SQL upit

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN current_setting('ssl_min_protocol_version') IN ('TLSv1.2','TLSv1.3') THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: SQL naredba

shell

psql -X -U "${PGUSER:-postgres}" -c "ALTER SYSTEM SET ssl_min_protocol_version = 'TLSv1.3'" -c "SELECT pg_reload_conf()"

Svojstva

Operativni sistemi: Bilo koji
Oznake: postgresdatabasetls
Referenca: CIS PostgreSQL 18 Benchmark v1.0.0 - 6.9 Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target postgres