CIS Benchmark Flags Postgres Account as Not Secure

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

CIS Benchmark flags the EDR 'postgres' user account as vulnerability ("5.4.2 Ensure system accounts are secured" ) since it is created with /bin/bash login environment.

Environment

• EDR Server: All Supported Versions

Cause

System accounts should be set to shell /sbin/nologin to maintain account security as part of OS security.

Resolution

The following command can be used to set postgres to nologin

usermod postgres -s /sbin/nologin

Additional Information

The default postgres system user, created during the installation of PostgreSQL, can be configured with /sbin/nologin or /usr/sbin/nologin as its shell. This configuration prevents direct interactive logins to the system as the postgres user.