Detections
Analytics

7.1 Ensure a replication-only user is created and used for streaming replication

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Create a new user specifically for use by streaming replication instead of using the superuser account.

As it is not necessary to be a superuser to initiate a replication connection, it is proper to create an account specifically for replication. This allows further 'locking down' the uses of the superuser account and follows the general principle of using the least privileges necessary.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

It will be necessary to create a new role for replication purposes:

postgres=# CREATE USER replication_user REPLICATION ENCRYPTED PASSWORD 'XXX';
CREATE ROLE
postgres=# SELECT rolname FROM pg_roles WHERE rolreplication;
 rolname
------------------
 postgres
 replication_user
(2 rows)

When using pg_basebackup (or other replication tools) on your standby server, you would use the replication_user (and its password).

Ensure you allow the new user via your pg_hba.conf file:

# note that 'replication' in the 2nd column is required and is a special
# keyword, not a real database
hostssl replication replication_user 0.0.0.0/0 scram-sha-256

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|4.3

Plugin: PostgreSQLDB

Control ID: 2a7859968c27b3fde91adc8d46045659ae60f8f2a5155041d863f076ea98e173