audit-labs/audit-tools
A collection of scripts, queries, and other goodies you can use in an audit.
clone: git clone https://gitbay.org/audit-labs/audit-tools.git
main: databases/postgres/README.md · raw
1# `passwords.sql`
2
3``` sql
4SELECT *
5FROM pg_settings
6WHERE name LIKE 'password_%';
7```
8
9 | name | setting | unit | category | short_desc | extra_desc | context | vartype | source | min_val | max_val | enumvals | boot_val | reset_val | sourcefile | sourceline | pending_restart |
10 |---------------------+---------------+------+-------------------------------------------------+-------------------------------------------------+------------+---------+---------+---------+---------+---------+---------------------+---------------+---------------+------------+------------+-----------------|
11 | password_encryption | scram-sha-256 | | Connections and Authentication / Authentication | Chooses the algorithm for encrypting passwords. | | user | enum | default | | | {md5,scram-sha-256} | scram-sha-256 | scram-sha-256 | | | false |
12
13``` sql
14SELECT
15 usename AS user_name,
16 passwd AS password,
17 valuntil AS valid_until,
18 useconfig AS user_config
19FROM pg_shadow;
20```
21
22 | user_name | password | valid_until | user_config |
23 |-----------+---------------------------------------------------------------------------------------------------------------------------------------+------------------------+-------------|
24 | cmc | | | |
25 | testuser | SCRAM-SHA-256$4096:+NSpEU+8afhJ4BUTkzdKeg==$FGIRcTWr89b42qkLUl4Ntfp4RUpoc3GIpLHqJl/fWZE=:o1UM8YiEj5SLV5l/geMuqXMRi6onWazryn/l+LXYMxU= | 2025-12-31 00:00:00-06 | |
26
27# `admins.sql`
28
29``` sql
30SELECT
31 r.rolname AS role_name,
32 r.rolsuper AS is_superuser,
33 r.rolinherit AS inherits_privileges,
34 r.rolcreaterole AS can_create_roles,
35 r.rolcreatedb AS can_create_db,
36 r.rolcanlogin AS can_login,
37 r.rolreplication AS can_replication,
38 r.rolconnlimit AS connection_limit,
39 r.rolvaliduntil AS valid_until,
40 ARRAY(
41 SELECT b.rolname
42 FROM pg_auth_members m
43 JOIN pg_roles b ON (m.roleid = b.oid)
44 WHERE m.member = r.oid
45 ) AS member_of
46FROM pg_roles r;
47```
48
49 | role_name | is_superuser | inherits_privileges | can_create_roles | can_create_db | can_login | can_replication | connection_limit | valid_until | member_of |
50 |-----------------------------+--------------+---------------------+------------------+---------------+-----------+-----------------+------------------+------------------------+--------------------------------------------------------------|
51 | cmc | true | true | true | true | true | true | -1 | | {} |
52 | pg_database_owner | false | true | false | false | false | false | -1 | | {} |
53 | pg_read_all_data | false | true | false | false | false | false | -1 | | {} |
54 | pg_write_all_data | false | true | false | false | false | false | -1 | | {} |
55 | pg_monitor | false | true | false | false | false | false | -1 | | {pg_read_all_settings,pg_read_all_stats,pg_stat_scan_tables} |
56 | pg_read_all_settings | false | true | false | false | false | false | -1 | | {} |
57 | pg_read_all_stats | false | true | false | false | false | false | -1 | | {} |
58 | pg_stat_scan_tables | false | true | false | false | false | false | -1 | | {} |
59 | pg_read_server_files | false | true | false | false | false | false | -1 | | {} |
60 | pg_write_server_files | false | true | false | false | false | false | -1 | | {} |
61 | pg_execute_server_program | false | true | false | false | false | false | -1 | | {} |
62 | pg_signal_backend | false | true | false | false | false | false | -1 | | {} |
63 | pg_checkpoint | false | true | false | false | false | false | -1 | | {} |
64 | pg_maintain | false | true | false | false | false | false | -1 | | {} |
65 | pg_use_reserved_connections | false | true | false | false | false | false | -1 | | {} |
66 | pg_create_subscription | false | true | false | false | false | false | -1 | | {} |
67 | testuser | false | true | false | false | true | false | -1 | 2025-12-31 00:00:00-06 | {} |