PostgreSQL must map the PKI-authenticated identity to an associated user account.

From PostgreSQL 9.x Security Technical Implementation Guide

Associated with: CCI-000187

SV-87707r1_rule PostgreSQL must map the PKI-authenticated identity to an associated user account.

Vulnerability discussion

The DoD standard for authentication is DoD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to PostgreSQL user account for the authenticated identity to be meaningful to PostgreSQL and useful for authorization decisions.

Check content

The cn (Common Name) attribute of the certificate will be compared to the requested database user name, and if they match the login will be allowed. To check the cn of the certificate, using openssl, do the following: $ openssl x509 -noout -subject -in client_cert If the cn does not match the users listed in PostgreSQL and no user mapping is used, this is a finding. User name mapping can be used to allow cn to be different from the database user name. If User Name Maps are used, run the following as the database administrator (shown here as "postgres"), to get a list of maps used for authentication: $ sudo su - postgres $ grep "map" ${PGDATA?}/pg_hba.conf With the names of the maps used, check those maps against the user name mappings in pg_ident.conf: $ sudo su - postgres $ cat ${PGDATA?}/pg_ident.conf If user accounts are not being mapped to authenticated identities, this is a finding. If the cn and the username mapping do not match, this is a finding.

Fix text

Configure PostgreSQL to map authenticated identities directly to PostgreSQL user accounts. For information on configuring PostgreSQL to use SSL, see supplementary content APPENDIX-G.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.