STIGQter: STIG Summary: EDB Postgres Advanced Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The EDB Postgres Advanced Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

DISA Rule

SV-213578r508024_rule

Vulnerability Number

V-213578

Group Title

SRG-APP-000109-DB-000321

Rule Version

PPS9-00-002400

Severity

CAT I

CCI(s)

• CCI-000140 - The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).

Weight

10

Fix Recommendation

Determine the max size of your audit log directory. For this fix, we will assume that the audit log directory has a max size of 100MB. Divide the max size of the directory by 10 to determine the size of your log files for rotation. Perform the following steps to ensure that the audit log directory is never more than 90% full and new logs always replace the oldest logs:

1) Add the following to the bottom of the /etc/logrotate.conf file:

<postgresql data directory>/edb_audit/audit.csv {
size 10M
dateext
dateformat .%Y-%m-%d.%s
copytruncate
rotate 8
}
(The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.)

2) Create the file /etc/cron.hourly/logrotate with these contents:

#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

3) Issue these SQL statements:

ALTER SYSTEM SET edb_audit_filename = 'audit';
SELECT pg_reload_conf();

Check Contents

If an externally managed and monitored partition or logical volume that can be grown dynamically is being used for logging, this is not a finding.  

If PPAS is auditing to a directory that is not being actively checked for availability of disk space, and if logrotate is not configured to rotate logs based on the size of the audit log directory with oldest logs being replaced by newest logs, this is a finding.

Vulnerability Number

V-213578

Documentable

False

Rule Version

PPS9-00-002400

Severity Override Guidance

If an externally managed and monitored partition or logical volume that can be grown dynamically is being used for logging, this is not a finding.  

If PPAS is auditing to a directory that is not being actively checked for availability of disk space, and if logrotate is not configured to rotate logs based on the size of the audit log directory with oldest logs being replaced by newest logs, this is a finding.

Check Content Reference

M

Target Key

3988

Comments