Lock Out Accounts if Not Currently in Use

中级别 1人工审核postgres

说明

If users with database accounts will not be using the database for some time, disabling the account will reduce the risk of attacks or inappropriate account usage.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Run SELECT rolname FROM pg_catalog.pg_roles WHERE rolname !~ '^pg_' AND rolcanlogin; and compare with the accounts currently in use. Inactive accounts must not appear in the output.

修复方式

修复方法: 操作指南或基础设施补丁

Lock unused accounts with ALTER ROLE <role> NOLOGIN; (re-enable with LOGIN when needed) or drop them.

属性

操作系统: 任意
标签: postgresdatabaseauthenticationmanual
参考: CIS PostgreSQL 18 Benchmark v1.0.0 - 4.4 Lock Out Accounts if Not Currently in Use