Ensure pg_hba.conf does not use 'trust' or 'password' authentication

严重级别 1自动化postgres

说明

trust allows login without any credential and password sends the password in clear text. The CIS PostgreSQL 18 Benchmark covers pg_hba.conf only through the manual checks 5.3/5.4; this rule automates that part by reading pg_hba_file_rules (superuser). Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

检查方式

审计方法: SQL 查询

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT count(*) FROM pg_hba_file_rules WHERE auth_method IN ('trust','password')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

预期输出: 0

修复方式

修复方法: 操作指南或基础设施补丁

Replace trust/password entries in pg_hba.conf with scram-sha-256 (or peer for local administrative sockets), then SELECT pg_reload_conf();

属性

操作系统: 任意
标签: postgresdatabaseauthenticationpg_hba
参考: CIS PostgreSQL 18 Benchmark v1.0.0 - 5.3 / 5.4 Ensure login via "local" UNIX Domain Socket / "host" TCP/IP Socket is configured correctly

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target postgres