STIGQter: STIG Summary: Crunchy Data PostgreSQL Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

PostgreSQL must be configured to provide audit record generation for DoD-defined auditable events within all DBMS/database components.

DISA Rule

SV-233580r617333_rule

Vulnerability Number

V-233580

Group Title

SRG-APP-000089-DB-000064

Rule Version

CD12-00-007400

Severity

CAT II

CCI(s)

• CCI-000169 - The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components.

Weight

10

Fix Recommendation

Configure PostgreSQL to generate audit records for at least the DoD minimum set of events.

Using "pgaudit", PostgreSQL can be configured to audit these requests. See supplementary content APPENDIX-B for documentation on installing pgaudit.

To ensure that logging is enabled, review supplementary content APPENDIX-C for instructions on enabling logging.

Check Contents

Note: The following instructions use the PGLOG environment variables. See supplementary content APPENDIX-I for instructions on configuring PGVER.

Check PostgreSQL audit logs to determine whether organization-defined auditable events are being audited by the system.

For example, if the organization defines 'CREATE TABLE' as an auditable event, issuing the following command should return a result:

$ sudo su - postgres
$ psql -c "CREATE TABLE example (id int)"
$ grep 'AUDIT:.*,CREATE TABLE.*example' ${PGLOG?}/<latest_log>
$ psql -c 'DROP TABLE example;'

If organization-defined auditable events are not being audited, this is a finding.

Vulnerability Number

V-233580

Documentable

False

Rule Version

CD12-00-007400

Severity Override Guidance

Note: The following instructions use the PGLOG environment variables. See supplementary content APPENDIX-I for instructions on configuring PGVER.

Check PostgreSQL audit logs to determine whether organization-defined auditable events are being audited by the system.

For example, if the organization defines 'CREATE TABLE' as an auditable event, issuing the following command should return a result:

$ sudo su - postgres
$ psql -c "CREATE TABLE example (id int)"
$ grep 'AUDIT:.*,CREATE TABLE.*example' ${PGLOG?}/<latest_log>
$ psql -c 'DROP TABLE example;'

If organization-defined auditable events are not being audited, this is a finding.

Check Content Reference

M

Target Key

5254

Comments