Ensure sudo is configured correctly

中等級 1人工審核postgres

說明

It is common to have more than one authorized individual administering the PostgreSQL service at the Operating System level. It is also quite common to permit login privileges to individuals on a PostgreSQL host who otherwise are not authorized to access the server's data cluster and files.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Check /etc/sudoers and /etc/sudoers.d: only an approved DBA group (e.g. %dba) may run commands as postgres. Test with an unauthorized user (sudo -iu postgres must be refused) and an authorized one.

修補方式

修補方法: 操作指南或基礎設施修補檔

Create a DBA group, add authorized users, and add '%dba ALL=(postgres) PASSWD: ALL' via visudo -f /etc/sudoers.d/postgres.

屬性

作業系統: 不限
標籤: postgresdatabaseauthenticationsudomanual
參考資料: CIS PostgreSQL 18 Benchmark v1.0.0 - 4.2 Ensure sudo is configured correctly