Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Could anyone provide a good resource or check-list for a security review of PostgreSQL?

share|improve this question

3 Answers 3

up vote 14 down vote accepted
+100

The IBM wrote an article on hardening PostgreSQL: Total security in a PostgreSQL database. Should work as a check-list if to apply a bit another way of thinking about problem (switch on hacker mind).

From Owasp there are two papers, focusing on this field: OWASP Backend Security Project Testing PostgreSQL, that describes SQL Injection techniques within the scope of PostgreSQL and OWASP Backend Security Project PostgreSQL Hardening, that describes requirements for secure PostgreSQL setup.

There is also a book, called "SQL Injection Attacks and Defense". Well, the title itself describes the contents. (There is possible to see what is included in.)

PS: probably, it might be interesting to read also about Security-Enhanced PostrgreSQL: http://wiki.postgresql.org/wiki/SEPostgreSQL

share|improve this answer

The US DoD has a general database security checklist and guide:

http://iase.disa.mil/stigs/checklist/

But not PostGres specifically.

share|improve this answer

These are the only two books I know that have chapters on PostgreSQL security.

  • The Database Hacker's Handbook, ISBN-13: 978-0764578014 (2005)

  • PostgreSQL Administration Cookbook, ISBN 13 : 978-1-84951-028-8 (2010)

share|improve this answer
3  
Confusion in relation to the term 'resource', I was using that to mean on-line resource (web pages to read etc.) But thank you for the sales pitch. –  David Stubley Mar 12 '11 at 9:05
1  
Sorry about that, I thought you meant you were looking for people to help you. I've edited my original response accordingly. –  user1715 Mar 22 '11 at 12:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.