Lock Out Accounts if Not Currently in Use

中等級 1人工審核postgres

說明

If users with database accounts will not be using the database for some time, disabling the account will reduce the risk of attacks or inappropriate account usage.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Run SELECT rolname FROM pg_catalog.pg_roles WHERE rolname !~ '^pg_' AND rolcanlogin; and compare with the accounts currently in use. Inactive accounts must not appear in the output.

修補方式

修補方法: 操作指南或基礎設施修補檔

Lock unused accounts with ALTER ROLE <role> NOLOGIN; (re-enable with LOGIN when needed) or drop them.

屬性

作業系統: 不限
標籤: postgresdatabaseauthenticationmanual
參考資料: CIS PostgreSQL 18 Benchmark v1.0.0 - 4.4 Lock Out Accounts if Not Currently in Use