Detections
Analytics
4.10 Ensure all accounts that can log in have passwords
Information
Every database role with the LOGIN attribute should have a password set unless it authenticates exclusively through a non-password method configured in pg_hba.conf, such as certificate, GSSAPI, or LDAP authentication.A login-capable role without a password relies entirely on the authentication method assigned to it in pg_hba.conf . If such a role is matched by a rule using a non-credential method such as trust, it can log in with no challenge at all. Ensuring every login role carries a credential, a password or an enrolled non-password authentication method, prevents accounts from existing without any means of verifying identity.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Set a password for each identified role using the psql \\password command, which hashes the password on the client so the plaintext never appears in the SQL stream or server logs:postgres=# \\password user1
Alternatively, if an identified role does not require interactive login, disable login instead:
postgres=# ALTER ROLE user1 NOLOGIN;
NOTE: ALTER ROLE ... PASSWORD 'plaintext' should be avoided: the plaintext password can be captured in the server log (if statement logging is enabled) and in client command history.
Impact:
Newly assigned passwords must be distributed to the affected users and applications and managed under the organization's password policy. Assigning a password has no effect on accounts whose pg_hba.conf rules use non-password authentication methods.
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CSCv7|4.4
Plugin: PostgreSQLDB
Control ID: 199b6dcea60b0b4c054c416eb8b321803a9c8cc357395a665241d088897ce5d6