Skip to main content

lacework-global-543

4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server (Automated)​

Profile Applicability​

• Level 1

Description​

Enable SSL connection on PostgreSQL Servers.

Rationale​

SSL connectivity helps to provide a new layer of security by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against "man in the middle" attacks by encrypting the data stream between the server and application.

Audit​

From Azure Portal​

  1. Login to Azure Portal using https://portal.azure.com
  2. Go to Azure Database for PostgreSQL server
  3. For each database, click on Connection security
  4. In SSL settings, ensure Enforce SSL connection is set to ENABLED.

From Azure CLI​

Ensure the output of the below command returns ENABLED.

az postgres server show --resource-group myresourcegroup --name <resourceGroupName> --query sslEnforcement

Remediation​

From Azure Portal​

  1. Login to Azure Portal using https://portal.azure.com
  2. Go to Azure Database for PostgreSQL server
  3. For each database, click on Connection security
  4. In SSL settings, click on ENABLED to enforce SSL connections
  5. Click Save

From Azure CLI​

Use the below command to enforce ssl connection for PostgreSQL Database.

az postgres server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled

References​

https://docs.microsoft.com/en-us/azure/postgresql/concepts-ssl-connection-security
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-4-encrypt-sensitive-information-in-transit