Skip to content

Support sha256 on Postgresql 10+ #24

Closed
@pmav99

Description

@pmav99

Postgresql 10+ supports scram-sha256 hashing for passwords. The inspect check though only allows md5.
More info here: https://paquier.xyz/postgresql-2/postgres-10-scram-authentication/

control 'postgres-13' do
impact 1.0
title 'Require MD5 for ALL users, peers in pg_hba.conf'
desc 'Require MD5 for ALL users, peers in pg_hba.conf and do not allow untrusted authentication methods.'
describe file(POSTGRES_HBA_CONF_FILE) do
its('content') { should match(/local\s.*?all\s.*?all\s.*?md5/) }
its('content') { should match(%r{host\s.*?all\s.*?all\s.*?127.0.0.1\/32\s.*?md5}) }
its('content') { should match(%r{host\s.*?all\s.*?all\s.*?::1\/128\s.*?md5}) }
its('content') { should_not match(/.*password/) }
its('content') { should_not match(/.*trust/) }
its('content') { should_not match(/.*crypt/) }
end
end

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions