Summary
Add a read-only collector that captures authentication and transport-security posture so downstream analysis can flag weak configuration. Individual GUCs are available today, but there is no transport-security view and host-based authentication is not collected at all.
Scope update (2026-08-14, Frank)
Originally scoped to an aggregate summary of host-based auth (counts by method, no addresses/roles/dbs). Expanded to full per-rule collection of pg_hba_file_rules: the aggregate-only redaction is dropped because it prevents actionable findings — the analysis layer must be able to point at the specific non-local rule using a weak method (e.g. trust on 0.0.0.0/0), not just report counts.
Collect
Transport security (from pg_settings_v1 / pg_settings)
ssl, ssl_min_protocol_version, ssl_ciphers (names only), and whether TLS is available/required.
Host-based authentication — full per-rule view
Source: the system view pg_catalog.pg_hba_file_rules (https://www.postgresql.org/docs/current/view-pg-hba-file-rules.html). SQL-queryable — no filesystem access needed. Emit one row per rule with the view's columns:
line_number, type, database (name[]), user_name (name[]), address, netmask, auth_method, options (text[]), errorrule_number and file_name where the server version exposes them (PG15+).
Follows the *_v1 contract (e.g. pg_hba_file_rules_v1).
Access requirement
pg_hba_file_rules is readable only by superusers or roles granted the predefined pg_read_all_settings role. The monitoring role therefore needs pg_read_all_settings (a bounded, read-only predefined role — not full superuser). Where the role lacks it, the view returns no rows / an error; the collector must degrade gracefully (empty + a completeness note, per the FC/false-clean contract) rather than fail.
Sanitization
Config metadata only — no credentials, no passwords, no secret material. Addresses, role names, and database names in HBA rules are configuration, not secrets, and the same role/db name class already appears in login_roles_v1; capture them. The error column surfaces per-line parse errors and should be preserved.
Why
Lets the analysis layer detect unencrypted-transport-allowed and weak host-auth methods (Analyzer #1757 tls-not-enforced + weak-host-auth), which are not surfaced today.
Summary
Add a read-only collector that captures authentication and transport-security posture so downstream analysis can flag weak configuration. Individual GUCs are available today, but there is no transport-security view and host-based authentication is not collected at all.
Scope update (2026-08-14, Frank)
Originally scoped to an aggregate summary of host-based auth (counts by method, no addresses/roles/dbs). Expanded to full per-rule collection of
pg_hba_file_rules: the aggregate-only redaction is dropped because it prevents actionable findings — the analysis layer must be able to point at the specific non-local rule using a weak method (e.g.truston0.0.0.0/0), not just report counts.Collect
Transport security (from
pg_settings_v1/pg_settings)ssl,ssl_min_protocol_version,ssl_ciphers(names only), and whether TLS is available/required.Host-based authentication — full per-rule view
Source: the system view
pg_catalog.pg_hba_file_rules(https://www.postgresql.org/docs/current/view-pg-hba-file-rules.html). SQL-queryable — no filesystem access needed. Emit one row per rule with the view's columns:line_number,type,database(name[]),user_name(name[]),address,netmask,auth_method,options(text[]),errorrule_numberandfile_namewhere the server version exposes them (PG15+).Follows the
*_v1contract (e.g.pg_hba_file_rules_v1).Access requirement
pg_hba_file_rulesis readable only by superusers or roles granted the predefinedpg_read_all_settingsrole. The monitoring role therefore needspg_read_all_settings(a bounded, read-only predefined role — not full superuser). Where the role lacks it, the view returns no rows / an error; the collector must degrade gracefully (empty + a completeness note, per the FC/false-clean contract) rather than fail.Sanitization
Config metadata only — no credentials, no passwords, no secret material. Addresses, role names, and database names in HBA rules are configuration, not secrets, and the same role/db name class already appears in
login_roles_v1; capture them. Theerrorcolumn surfaces per-line parse errors and should be preserved.Why
Lets the analysis layer detect unencrypted-transport-allowed and weak host-auth methods (Analyzer #1757
tls-not-enforced+weak-host-auth), which are not surfaced today.