Ensure Passwords are Not Stored in the service file

中等級 1人工審核postgres

說明

One can set a password in a PostgreSQL connection service file. Verify the password option is not used in a connection service file.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

As root search connection service files for passwords: find / -name .pg_service.conf -type f -exec grep -H password {} \; 2>/dev/null; grep password /root/.pg_service.conf "${PGSERVICEFILE}" "${PGSYSCONFDIR}/pg_service.conf". Any password=... line is a finding.

修補方式

修補方法: 操作指南或基礎設施修補檔

Remove password= entries from pg_service.conf/.pg_service.conf files and store credentials in ~/.pgpass (mode 0600) or use certificate authentication.

屬性

作業系統: 不限
標籤: postgresdatabasecredentialsmanual
參考資料: CIS PostgreSQL 18 Benchmark v1.0.0 - 2.4 Ensure Passwords are Not Stored in the service file