Detections
Analytics

4.10 Ensure all accounts that can log in have passwords

Information

If not using certificate-based authentication, all database accounts that have the ability to login should have a password set.

All accounts that can login to the database should challenge the user for an SSL certificate or an account password.

Solution

Set a valid password for any database user identified above.

postgres=# \\password user1

This shows setting the password for user1 . You can use ALTER ROLE, but note that the passwords will be emitted to the PostgreSQL logs.

Impact:

Note that if no password has been set up for a user, the stored password is null and password authentication will always fail for that user.

See Also

https://workbench.cisecurity.org/benchmarks/24868

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CSCv7|4.4

Plugin: PostgreSQLDB

Control ID: e14eb18725d2b81112712e30b9ad0d52a0dbdf5999f63d0d2af519d4a639f1ef