Ensure login via "local" UNIX Domain Socket is configured correctly

高等級 1人工審核postgres

說明

A remote host login, via SSH, is arguably the most secure means of remotely accessing and administering the PostgreSQL server. Once connected to the PostgreSQL server, using the psql client, via UNIX DOMAIN SOCKETS, while using the peer authentication method is the most secure mechanism available for local database connections.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Review the 'local' lines of pg_hba.conf (SELECT * FROM pg_hba_file_rules WHERE type = 'local';). As user1 run psql -U postgres -d postgres: it must fail with 'Peer authentication failed'; as postgres it must succeed. Local login as another account than your own is a fail.

修補方式

修補方法: 操作指南或基礎設施修補檔

Use 'local all all peer' (or 'local all postgres peer') as the local rule, create database roles that match OS users that need access, then SELECT pg_reload_conf();

屬性

作業系統: 不限
標籤: postgresdatabaseauthenticationpg_hbamanual
參考資料: CIS PostgreSQL 18 Benchmark v1.0.0 - 5.3 Ensure login via "local" UNIX Domain Socket is configured correctly