Baseline configurations

From: Mike Orr <sluggoster(at)gmail(dot)com>
To: pgsql-general(at)postgresql(dot)org
Subject: Baseline configurations
Date: 2012-08-30 19:18:11
Message-ID: CAH9f=uoT4c7Z4NFB6AGk930+5Qg-GJPS8OtopHS3i6tpPFP2SA@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Does PostgreSQL have any baseline security configuration documents?
(Aka "hardened" configuration "benchmark" checklist.) My organization
is asking for official or vendor-supported baseline configurations for
all our software. I looked through the PG manual, the security page on
the website, and in Google and found some discussions about
customizing role permissions and SSL connections, but nothing that
covered the entirety of the software like this one for MySQL:

http://benchmarks.cisecurity.org/en-us/?route=downloads.show.single.mysql.102
(Center for Internet Security). I can't link directly to the document
because it's behind a download form, but the TOC outline covers: OS
level configuration, file system permissions, logging, general
(default test databases, accounts), database/table permissions,
configuration options, backup/recovery. Each recommendation specifies
whether it's scoreable (verifiable by an audit program), and its
tradeoffs (i.e., whether it might be too burdensome or a bad idea in
various situations).

If I can't find such a checklist for PostgreSQL I can write my own,
but it would be more authoritative if it were an official PostgreSQL
document or supported by a vendor or organization.

Thanks in advance. I've been a happy PostgreSQL user for two or three years now.

--
Mike Orr <sluggoster(at)gmail(dot)com>

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Seref Arikan 2012-08-30 19:44:07 Re: Performance implications of adding a "disabled" column to a table
Previous Message David Johnston 2012-08-30 19:09:31 Re: Performance implications of adding a "disabled" column to a table