PostgreSQL Security Audit

Question

Could anyone provide a good resource or check-list for a security review of PostgreSQL?

Answer 1

The IBM wrote an article on hardening PostgreSQL: Total security in a PostgreSQL database. Should work as a check-list if to apply a bit another way of thinking about problem (switch on hacker mind).

From Owasp there are two papers, focusing on this field: OWASP Backend Security Project Testing PostgreSQL, that describes SQL Injection techniques within the scope of PostgreSQL and OWASP Backend Security Project PostgreSQL Hardening, that describes requirements for secure PostgreSQL setup.

There is also a book, called "SQL Injection Attacks and Defense". Well, the title itself describes the contents. (There is possible to see what is included in.)

PS: probably, it might be interesting to read also about Security-Enhanced PostrgreSQL: http://wiki.postgresql.org/wiki/SEPostgreSQL

Answer 2

The US DoD has a general database security checklist and guide:

http://iase.disa.mil/stigs/checklist/

But not PostGres specifically.

Answer 3

These are the only two books I know that have chapters on PostgreSQL security.

• The Database Hacker's Handbook, ISBN-13: 978-0764578014 (2005)

• PostgreSQL Administration Cookbook, ISBN 13 : 978-1-84951-028-8 (2010)