Detections
Analytics

1.6 Verify That 'PGPASSWORD' is Not Set in Users' Profiles

Information

PostgreSQL can read a default database password from an environment variable called PGPASSWORD.

Use of the PGPASSWORD environment variable implies PostgreSQL credentials are stored as clear text. Avoiding this may increase assurance that the confidentiality of PostgreSQL credentials is preserved.

Solution

Check which users and/or scripts are setting PGPASSWORD and change them to use a more secure method.

See Also

https://workbench.cisecurity.org/benchmarks/24868

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1)

Plugin: Unix

Control ID: 2592345a1806f01491c9920e2b37abd9c177c61f430003227952dadf9dcdb5ba