STIGQter: STIG Summary: EDB Postgres Advanced Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The EDB Postgres Advanced Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

DISA Rule

SV-213628r508024_rule

Vulnerability Number

V-213628

Group Title

SRG-APP-000383-DB-000364

Rule Version

PPS9-00-008700

Severity

CAT II

CCI(s)

• CCI-001762 - The organization disables organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

Disable each prohibited network function, port, protocol, or service prohibited by the PPSM guidance.

Open "<postgresql data directory>/pg_hba.conf" in an editor. (The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.) Change the TYPE of any rows not starting with a "#" to be either "local" or "hostssl". The METHOD for the local rows should be "peer", which will authenticate based on the operating system name. The METHOD for the hostssl rows should be one of these (in preferred order): cert, ldap, sspi, pam, md5

Execute the following SQL as enterprisedb:

ALTER SYSTEM SET port = <port>;

Execute the following operating system command as root:

systemctl restart ppas-9.5.service

Check Contents

Review the network functions, ports, protocols, and services supported by the DBMS.

If any protocol is prohibited by the PPSM guidance and is enabled, this is a finding.

Open "<postgresql data directory>/pg_hba.conf" in a viewer. (The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.) If any rows have a TYPE that is "host" or "hostnossl", this is a finding.

Execute the following SQL as enterprisedb:

SHOW port;

If the displayed port is not allowed, this is a finding.

Vulnerability Number

V-213628

Documentable

False

Rule Version

PPS9-00-008700

Severity Override Guidance

Review the network functions, ports, protocols, and services supported by the DBMS.

If any protocol is prohibited by the PPSM guidance and is enabled, this is a finding.

Open "<postgresql data directory>/pg_hba.conf" in a viewer. (The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.) If any rows have a TYPE that is "host" or "hostnossl", this is a finding.

Execute the following SQL as enterprisedb:

SHOW port;

If the displayed port is not allowed, this is a finding.

Check Content Reference

M

Target Key

3988

Comments