dev-sec / postgres-baseline Goto Github PK

Postgresql 10+ supports scram-sha256 hashing for passwords. The inspect check though only allows md5.
More info here: https://paquier.xyz/postgresql-2/postgres-10-scram-authentication/

Can we please have the spec updated to allow 9.6 and 10.5? Additionally, the spec should not allow versions that are EOL, per https://www.postgresql.org/support/versioning/

As highlighted in #16, the inspec test (https://github.com/dev-sec/postgres-baseline/blob/master/controls/postgres_spec.rb#L69-L73) for:

describe service(postgres.service) do
   it { should be_installed }
   it { should be_running }
   it { should be_enabled }
end

do not work well across all operating systems. We need to investigate if this is caused by docker or by inspec.

Any plans for having postgres-baseline with ansible?

Description

I'm adding the ansible version of the hardening progress at dev-sec/ansible-collection-hardening#725. Some PostgreSQL versions are EOL, and some other new versions are not supported.

Solution

No response

Alternatives

No response

Additional information

...

Describe the bug
We're trying to run the postgres inspec as an inspec user so that we don't need to configure password authentication for our DB owner. However we see two problems when this happens:

1. The control doesn't specify a database name, so it attempts to log into a database named after the user. Since we don't have an inspec database to match, it fails to create a postgres_session.
2. Checks like ownership seem to assume that the user we specify will be the DB owner, with failures like "message": "expected File /var/lib/postgresql/12/main.owned_by?("inspec") to be truthy, got false",

Expected behavior
We had hoped to be able to run this as a user other than the DB owner/superuser. Is that possible?

Actual behavior

Apparently it has to run as the DB owner (postgres) and so we'd have to allow md5 auth from 127.0.0.1. That would be a huge security concern to me. Hopefully I'm missing something obvious.

Example code

/opt/chef/embedded/bin/inspec exec https://github.com/dev-sec/postgres-baseline/archive/master.zip --reporter=json --input-file /opt/foo/inspec-cron/postgres-inputs.yaml | jq -c '.profiles[].controls | map(.results=(.results | map(select(.status=="failed"))) | select(.results | length > 0)) | .[] | {inspec: .}' >> /var/log/inspec-reports/postgres-report.json

OS / Environment

$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.6 LTS"

Inspec Version
Our inspec script pulls https://github.com/dev-sec/postgres-baseline/archive/master.zip every time.