Ensure streaming replication parameters are configured correctly

中级别 1人工审核postgres

说明

Streaming replication from a PRIMARY host transmits DDL, DML, passwords, and other potentially sensitive activities and data. These connections should be protected with Secure Sockets Layer (SSL).

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Confirm a dedicated non-superuser replication role exists (SELECT rolname FROM pg_roles WHERE rolreplication;) and, from the standby, that psql 'host=<primary> dbname=postgres user=replication_user sslmode=require' -c 'select 1;' succeeds; check primary_conninfo on the standby uses sslmode=require or stronger.

修复方式

修复方法: 操作指南或基础设施补丁

On the standby set primary_conninfo = 'host=<primary> user=replication_user sslmode=verify-full ...' (and primary_slot_name), create standby.signal, and allow only hostssl replication entries on the primary.

属性

操作系统: 任意
标签: postgresdatabasereplicationtlsmanual
参考: CIS PostgreSQL 18 Benchmark v1.0.0 - 7.5 Ensure streaming replication parameters are configured correctly