Detections
Analytics

4.9 Make use of predefined roles

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

PostgreSQL provides a set of predefined roles that provide access to certain commonly needed privileged capabilities and information. Administrators can GRANT these roles to users and/or other roles in their environment, providing those users with access to the specified capabilities and information.

In keeping with the principle of least privilege, judicious use of the PostgreSQL predefined roles can greatly limit the access to privileged, or superuser, access.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

If you've determined that one or more of the predefined roles can be used, simply GRANT it:

postgres=# GRANT pg_monitor TO doug;
GRANT ROLE

And then remove superuser from the account:

postgres=# ALTER ROLE doug NOSUPERUSER;
ALTER ROLE
postgres=# select rolname from pg_roles where rolsuper is true;
 rolname
----------
 postgres
(1 row)

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|5.1

Plugin: PostgreSQLDB

Control ID: b873a65bfc3a41e370fa432ea720b79ddbc56c5d3be96aab13da606abfa2f8c1