TMA-POSTGRES-4.2
Ensure sudo is configured correctly
Açıklama
It is common to have more than one authorized individual administering the PostgreSQL service at the Operating System level. It is also quite common to permit login privileges to individuals on a PostgreSQL host who otherwise are not authorized to access the server's data cluster and files.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
Check /etc/sudoers and /etc/sudoers.d: only an approved DBA group (e.g. %dba) may run commands as postgres. Test with an unauthorized user (sudo -iu postgres must be refused) and an authorized one.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Create a DBA group, add authorized users, and add '%dba ALL=(postgres) PASSWD: ALL' via visudo -f /etc/sudoers.d/postgres.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- postgresdatabaseauthenticationsudomanual
- Referans
- CIS PostgreSQL 18 Benchmark v1.0.0 - 4.2 Ensure sudo is configured correctly