TMA-POSTGRES-4.3
Ensure excessive administrative privileges are revoked
Açıklama
With respect to PostgreSQL administrative SQL commands, only superusers should have elevated privileges. PostgreSQL regular, or application, users should not possess the ability to create roles, create new databases, manage replication, or perform any other action deemed privileged.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
Run psql -c "\du+" and review role attributes (Superuser, Create role, Create DB, Replication, Bypass RLS). Only designated administrative roles may hold them; any regular role with administrative attributes is a fail.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Revoke unneeded attributes, e.g. ALTER ROLE <role> NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- postgresdatabaseauthorizationmanual
- Referans
- CIS PostgreSQL 18 Benchmark v1.0.0 - 4.3 Ensure excessive administrative privileges are revoked