Ensure Passwords are Not Stored in the service file

中级别 1人工审核postgres

说明

One can set a password in a PostgreSQL connection service file. Verify the password option is not used in a connection service file.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

As root search connection service files for passwords: find / -name .pg_service.conf -type f -exec grep -H password {} \; 2>/dev/null; grep password /root/.pg_service.conf "${PGSERVICEFILE}" "${PGSYSCONFDIR}/pg_service.conf". Any password=... line is a finding.

修复方式

修复方法: 操作指南或基础设施补丁

Remove password= entries from pg_service.conf/.pg_service.conf files and store credentials in ~/.pgpass (mode 0600) or use certificate authentication.

属性

操作系统: 任意
标签: postgresdatabasecredentialsmanual
参考: CIS PostgreSQL 18 Benchmark v1.0.0 - 2.4 Ensure Passwords are Not Stored in the service file