implementing-pam-for-database-access

Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL. Covers session proxy configuration, credential vaulting, query auditing, dynamic credentia

설치로 이동

저장소: xalgord/xalgorix
최근 소스 활동: 2026년 6월 6일 16:41
감지된 SKILL.md 언어: 영어
스타: 813
포크: 146

설치 방법

기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.

npx skills add https://github.com/xalgord/xalgorix --skill implementing-pam-for-database-access

명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.

로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.

소스 파일 검토

설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.

SKILL.md

소스 지침 · 읽기 전용 미리보기

검색으로 돌아가기 설치로 돌아가기

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

이 저장소의 모든 Skills 보기

Implementing PAM for Database Access

Overview

When to Use

When deploying or configuring implementing pam for database access capabilities in your environment

When establishing security controls aligned to compliance requirements

When building or improving security architecture for this domain

When conducting security assessments that require this implementation

Common Misconfigurations & Verification

Database PAM is routinely bypassed because the direct network path to the DB stays open:

Proxy vaulting but direct port still reachable: credentials are vaulted and a session proxy exists, yet DBAs connect straight to 1521/1433/5432/3306 with their own logins, bypassing audit entirely. Verify the DB host firewall/listener only accepts connections from the PAM proxy IP, then attempt a direct connect from a workstation — it must be refused. Cross-check DB-native audit (pg_stat_activity / SQL Server sys.dm_exec_sessions / Oracle V$SESSION) and confirm every client_addr is the proxy.

Shared DBA accounts not vaulted / no per-user attribution: confirm sa, SYS, postgres, root@% are checked out through PAM and that proxy logs map each session to a named human, not a shared login.

No automatic rotation after checkout: if the vaulted password is not rotated on check-in, a DBA who memorized it retains direct access. Confirm one-time-use / rotate-on-checkin is enabled and test that the previous password fails.

Query auditing captures connect but not statements: verify the proxy logs actual SQL (not just session start/stop) and that privileged statements (GRANT, DROP, bulk SELECT on PII) trigger alerts.

Least-privilege roles bypassed via direct superuser grant: confirm vaulted accounts use scoped roles, not blanket DBA/sysadmin/SUPERUSER.

Dynamic credential users left orphaned: if using dynamic DB creds, confirm expired users are dropped (no accumulating v-* roles) and SIEM receives all PAM session events.