STIGQter: STIG Summary: EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The EDB Postgres Advanced Server must enforce access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).

DISA Rule

SV-224201r508023_rule

Vulnerability Number

V-224201

Group Title

SRG-APP-000380-DB-000360

Rule Version

EP11-00-008500

Severity

CAT II

CCI(s)

• CCI-001813 - The information system enforces access restrictions.

Weight

10

Fix Recommendation

Configure EDB Postgres Advanced Server to enforce access restrictions associated with changes to the configuration of the EDB Postgres database(s).

Remove superuser rights from unauthorized database users via the ALTER ROLE or ALTER USER SQL command.

The syntax is:
ALTER ROLE <role> NOSUPERUSER
or
ALTER USER <user> NOSUPERUSER

Example:
ALTER ROLE testuser NOSUPERUSER;
OR
ALTER USER testuser NOSUPERUSER;

Use the REVOKE SQL command to remove privileges from databases and schemas.

For example:
REVOKE ALL PRIVILEGES ON <table> FROM <role_name>;

Check Contents

Review the security configuration of the EDB Postgres database(s).

If EDB Postgres Advanced Server does not enforce access restrictions associated with changes to the configuration of the database(s), this is a finding.

- - - - -

To assist in conducting reviews of permissions, the following commands, which are run using psql, describe permissions of databases, schemas, and users:

\l
\dn+
\du

Permissions of concern in this respect include the following, and possibly others:

- any user with SUPERUSER privileges
- any database or schema with "C" (create) or "w" (update) privileges that are not necessary

If any users are listed that have SUPERUSER privileges who are not authorized for these privileges, this is a finding.

If any user has create or update privileges on a database and schema who is not authorized for these privileges, this is a finding.

Vulnerability Number

V-224201

Documentable

False

Rule Version

EP11-00-008500

Severity Override Guidance

Review the security configuration of the EDB Postgres database(s).

If EDB Postgres Advanced Server does not enforce access restrictions associated with changes to the configuration of the database(s), this is a finding.

- - - - -

To assist in conducting reviews of permissions, the following commands, which are run using psql, describe permissions of databases, schemas, and users:

\l
\dn+
\du

Permissions of concern in this respect include the following, and possibly others:

- any user with SUPERUSER privileges
- any database or schema with "C" (create) or "w" (update) privileges that are not necessary

If any users are listed that have SUPERUSER privileges who are not authorized for these privileges, this is a finding.

If any user has create or update privileges on a database and schema who is not authorized for these privileges, this is a finding.

Check Content Reference

M

Target Key

4107

Comments