Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

YüksekDüzey 1Otomatikpostgres

Açıklama

Transport Layer Security (TLS), and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols which can be used to encrypt data sent between client and server. Passes for TLSv1.2 or TLSv1.3 (preferred). Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

Nasıl denetlenir

Denetim yöntemi: SQL sorgusu

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN current_setting('ssl_min_protocol_version') IN ('TLSv1.2','TLSv1.3') THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: SQL ifadesi

shell

psql -X -U "${PGUSER:-postgres}" -c "ALTER SYSTEM SET ssl_min_protocol_version = 'TLSv1.3'" -c "SELECT pg_reload_conf()"

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: postgresdatabasetls
Referans: CIS PostgreSQL 18 Benchmark v1.0.0 - 6.9 Ensure the TLSv1.0 and TLSv1.1 Protocols are Disabled

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target postgres