STIGQter: STIG Summary: PostgreSQL 9.x Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (functions, trigger procedures, links to software external to PostgreSQL, etc.) must be restricted to authorized users.

DISA Rule

SV-214060r508027_rule

Vulnerability Number

V-214060

Group Title

SRG-APP-000133-DB-000362

Rule Version

PGS9-00-001300

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

As the database administrator, revoke any permissions from a role that are deemed unnecessary by running the following SQL:

ALTER ROLE bob NOCREATEDB;
ALTER ROLE bob NOCREATEROLE;
ALTER ROLE bob NOSUPERUSER;
ALTER ROLE bob NOINHERIT;
REVOKE SELECT ON some_function FROM bob;

Check Contents

Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA.

As the database administrator (shown here as "postgres"), list all users and their permissions by running the following SQL:

$ sudo su - postgres
$ psql -c "\dp *.*"

Verify that all objects have the correct privileges. If they do not, this is a finding.

Next, as the database administrator (shown here as "postgres"), verify the permissions of the database directory on the filesystem:

$ ls -la ${PGDATA?}

If permissions of the database directory are not limited to an authorized user account, this is a finding.

Vulnerability Number

V-214060

Documentable

False

Rule Version

PGS9-00-001300

Severity Override Guidance

Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA.

As the database administrator (shown here as "postgres"), list all users and their permissions by running the following SQL:

$ sudo su - postgres
$ psql -c "\dp *.*"

Verify that all objects have the correct privileges. If they do not, this is a finding.

Next, as the database administrator (shown here as "postgres"), verify the permissions of the database directory on the filesystem:

$ ls -la ${PGDATA?}

If permissions of the database directory are not limited to an authorized user account, this is a finding.

Check Content Reference

M

Target Key

3994

Comments