Detections
Analytics

6.8 Ensure TLS is enabled and configured correctly

Information

The ssl parameter enables TLS encryption of TCP/IP traffic between the server and its clients, using the server certificate and private key identified by ssl_cert_file and ssl_key_file . Enabling ssl makes TLS available but does not require clients to use it; enforcement requires that all TCP/IP records in pg_hba.conf use the hostssl type. Both must be configured for TLS to be enabled and enforced.

If TLS is not enabled and enforced, credentials and data transmitted between the server and its clients traverse the network in cleartext, exposing them to eavesdropping and man-in-the-middle attacks.

Solution

Note: A self-signed certificate can be used for testing, but a certificate signed by a certificate authority (CA) should be used in production so that clients can verify the server's identity.

The following commands must be run as the postgres operating system user, and <dbhost.yourdomain.com> must be replaced with the server's hostname as clients will reference it:

# create new self-signed certificate and key
openssl req -new -x509 -days 365 -nodes -text -out server.crt -keyout server.key -subj "/CN=<dbhost.yourdomain.com>"

# copy .key and .crt files to appropriate location, here default $PGDATA
cp server.key server.crt $PGDATA

# restrict file mode for server.key
chmod og-rwx $PGDATA/server.key

Edit postgresql.conf to set the following parameters (changes require a restart):

ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

Update pg_hba.conf so that all TCP/IP records use the hostssl type, replacing any host or hostnossl records, for example:

hostssl all all 0.0.0.0/0 scram-sha-256
hostssl all all ::/0 scram-sha-256

Finally, restart PostgreSQL, which applies both files, and confirm the configuration using the commands outlined in the Audit Procedure.

Impact:

Enabling ssl and setting the certificate and key file parameters requires a cluster restart. Once hostssl is enforced, any client not configured for TLS will be refused; all applications, connection poolers, monitoring tools, and replication clients must be configured for TLS before enforcement. An expired server certificate will cause connection failures where certificate verification is in use, and a passphrase-protected private key prevents unattended server startup unless ssl_passphrase_command is configured.

See Also

https://workbench.cisecurity.org/benchmarks/26344

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: PostgreSQLDB

Control ID: d85592494c214e499686e874a2fd6e9762a30230c16f404396ba79a308ab728c