Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

VMware vSphere 6.7 PostgreSQL Security Technical Implementation Guide

V1R2 · · · Released 26 Jul 2023 · 22 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Digest of Updates vs. V1R1 · 09 Mar 2021 +2 −2 ✎ 19

Comparison against the immediately-prior release (V1R1). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 2

  • V-257281 High The version of PostgreSQL running on the system must be a supported version.
  • V-257296 Medium Data from the vPostgres database must be protected from unauthorized transfer.

Removed rules 2

  • V-239210 Medium Data from the vPostgres database must be protected from unauthorized transfer.
  • V-239217 Medium The vPostgres database security updates and patches must be installed in a timely manner in accordance with site policy.

Content changes 19

  • V-239196 Medium description VMware Postgres must limit the number of connections.
  • V-239197 Medium description VMware Postgres log files must contain required fields.
  • V-239198 Medium description VMware Postgres configuration files must not be accessible by unauthorized users.
  • V-239199 Medium description VMware Postgres must be configured to overwrite older logs when necessary.
  • V-239200 Medium description VMware Postgres database must protect log files from unauthorized access and modification.
  • V-239201 Medium description All VCDB tables must be owned by the "vc" user account.
  • V-239202 Medium description VMware Postgres must limit modify privileges to authorized accounts.
  • V-239204 High description VMware Postgres must require authentication on all connections.
  • V-239205 High description VMware Postgres must be configured to use TLS.
  • V-239206 High description VMware Postgres must enforce authorized access to all PKI private keys.
  • V-239207 High description VMware Postgres must use FIPS 140-2 approved TLS ciphers.
  • V-239208 Medium description VMware Postgres must write log entries to disk prior to returning operation success or failure.
  • V-239209 Medium description VMware Postgres must not allow schema access to unauthorized accounts.
  • V-239211 Medium description VMware Postgres must provide non-privileged users with minimal error information.
  • V-239212 Medium description VMware Postgres must have log collection enabled.
  • V-239213 Medium description VMware Postgres must be configured to log to stderr.
  • V-239214 Medium description Rsyslog must be configured to monitor VMware Postgres logs.
  • V-239215 Medium description VMware Postgres must use Coordinated Universal Time (UTC) for log timestamps.
  • V-239216 Medium description VMware Postgres must set client-side character encoding to UTF-8.
Sort by
b
VMware Postgres must limit the number of connections.
AC-10 - Medium - CCI-000054 - V-239196 - SV-239196r879511_rule
RMF Control
AC-10
Severity
M
CCI
CCI-000054
Version
VCPG-67-000001
Vuln IDs
  • V-239196
Rule IDs
  • SV-239196r879511_rule
Database management includes the ability to control the number of users and user sessions utilizing a DBMS. Unlimited concurrent connections to the DBMS could allow a successful denial-of-service (DoS) attack by exhausting connection resources, and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. VMware Postgres as deployed on the VCSA comes preconfigured with a max_connections limit that is appropriate for all tested, supported scenarios. The out-of-the-box configuration is dynamic, based on a lower limit plus allowances for the resources assigned to VCSA and the deployment size. However, this number will always be between 100 and 1000 (inclusive).
Checks: C-42429r878104_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW max_connections;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: 345 If the output does not match the expected result, this is a finding.

Fix: F-42388r678960_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET max_connections TO '345';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
VMware Postgres log files must contain required fields.
AU-12 - Medium - CCI-000169 - V-239197 - SV-239197r879559_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
VCPG-67-000002
Vuln IDs
  • V-239197
Rule IDs
  • SV-239197r879559_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. As an embedded database that is only accessible via localhost, VMware Postgres on the VCSA does not implement robust auditing. However, it can and must be configured to log reasonable levels of information relating to user actions to enable proper troubleshooting. Satisfies: SRG-APP-000089-DB-000064, SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000375-DB-000323
Checks: C-42430r678962_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW log_line_prefix;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: %m %c %x %d %u %r %p %l If the output does not match the expected result, this is a finding.

Fix: F-42389r678963_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_line_prefix TO '%m %c %x %d %u %r %p %l ';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
VMware Postgres configuration files must not be accessible by unauthorized users.
AU-12 - Medium - CCI-000171 - V-239198 - SV-239198r879560_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000171
Version
VCPG-67-000003
Vuln IDs
  • V-239198
Rule IDs
  • SV-239198r879560_rule
VMware Postgres has several configuration files that directly control the security posture of the DBMS. Protecting these files from unauthorized access and modification is fundamental to ensuring the security of VMware Postgres. Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-APP-000090-DB-000065, SRG-APP-000121-DB-000202, SRG-APP-000122-DB-000203, SRG-APP-000123-DB-000204, SRG-APP-000380-DB-000360
Checks: C-42431r678965_chk

At the command prompt, enter the following command: # find /storage/db/vpostgres/*conf* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group users ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Fix: F-42390r678966_fix

At the command prompt, enter the following command: # chmod 600 <file> # chown vpostgres:users <file> Note: Replace <file> with the file with incorrect permissions.

b
VMware Postgres must be configured to overwrite older logs when necessary.
AU-5 - Medium - CCI-000140 - V-239199 - SV-239199r879571_rule
RMF Control
AU-5
Severity
M
CCI
CCI-000140
Version
VCPG-67-000004
Vuln IDs
  • V-239199
Rule IDs
  • SV-239199r879571_rule
Without proper configuration, log files for VMware Postgres can grow without bound, filling the partition and potentially affecting the availability of the VCSA. One part of this configuration is to ensure that the logging subsystem overwrites, rather than appending to, any previous logs that would share the same name. This is avoided in other configuration steps, but this best practice should also be followed.
Checks: C-42432r678968_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW log_truncate_on_rotation;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: on If the output does not match the expected result, this is a finding.

Fix: F-42391r678969_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_truncate_on_rotation TO 'on';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
VMware Postgres database must protect log files from unauthorized access and modification.
AU-9 - Medium - CCI-000162 - V-239200 - SV-239200r879576_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
VCPG-67-000005
Vuln IDs
  • V-239200
Rule IDs
  • SV-239200r879576_rule
If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061
Checks: C-42433r678971_chk

At the command prompt, enter the following command: # find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group users ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Fix: F-42392r678972_fix

At the command prompt, enter the following command: # chmod 600 <file> # chown vpostgres:users <file> Note: Replace <file> with the file with incorrect permissions. At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_file_mode TO '0600';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
All VCDB tables must be owned by the "vc" user account.
CM-5 - Medium - CCI-001499 - V-239201 - SV-239201r879586_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
VCPG-67-000008
Vuln IDs
  • V-239201
Rule IDs
  • SV-239201r879586_rule
Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Database functions and procedures can be coded using definer's rights. This allows anyone who uses the object to perform the actions if they were the owner. If not properly managed, this can lead to privileged actions being taken by unauthorized individuals. VCDB is configured out of the box to be owned by the "vc" Postgres user. This configuration must be verified and maintained.
Checks: C-42434r678974_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -d VCDB -x -U postgres -c "\dt;"|grep Owner|grep -v vc If any tables are returned, this is a finding.

Fix: F-42393r678975_fix

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER TABLE <tablename> OWNER TO vc;" Replace <tablename> with the name of the table discovered during the check.

b
VMware Postgres must limit modify privileges to authorized accounts.
CM-5 - Medium - CCI-001499 - V-239202 - SV-239202r879586_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001499
Version
VCPG-67-000009
Vuln IDs
  • V-239202
Rule IDs
  • SV-239202r879586_rule
If VMware Postgres were to allow any user to make changes to database structure or logic, those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components to initiate changes, including upgrades and modifications. Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.
Checks: C-42435r678977_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "\du;"|grep "Create" Expected result: postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {} vc | Create DB | {} If the accounts other than "postgres" and "vc" have any "Create" privileges, this is a finding.

Fix: F-42394r678978_fix

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "REVOKE ALL PRIVILEGES FROM <user>;" Replace <user> with the account discovered during the check.

b
VMware Postgres must be configured to use the correct port.
CM-7 - Medium - CCI-000382 - V-239203 - SV-239203r879588_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000382
Version
VCPG-67-000011
Vuln IDs
  • V-239203
Rule IDs
  • SV-239203r879588_rule
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols/services on information systems. Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the application must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality-of-life issues. Database management systems using ports, protocols, and services deemed unsafe are open to attack through those ports, protocols, and services. This can allow unauthorized access to the database and through the database to other components of the information system. Satisfies: SRG-APP-000142-DB-000094, SRG-APP-000383-DB-000364
Checks: C-42436r678980_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW port;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: 5432 If the output does not match the expected result, this is a finding.

Fix: F-42395r678981_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET port TO '5432';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

c
VMware Postgres must require authentication on all connections.
IA-2 - High - CCI-000764 - V-239204 - SV-239204r879589_rule
RMF Control
IA-2
Severity
H
CCI
CCI-000764
Version
VCPG-67-000012
Vuln IDs
  • V-239204
Rule IDs
  • SV-239204r879589_rule
To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. VMware Postgres client authentication is configured in "pg_hba.conf". In this file are a number of lines that specify who can connect to the service, from where, and using what authentication methods. In Postgres there is a concept of a trusted connection where a specific network mask can connect without any authentication, to any account. This connection is termed "trust" in "pg_hba.conf" and it must not be present. Out of the box, VMware Postgres requires standard password authentication for all connections. Satisfies: SRG-APP-000148-DB-000103, SRG-APP-000171-DB-000074
Checks: C-42437r678983_chk

At the command prompt, execute the following command: # grep -v "^#" /storage/db/vpostgres/pg_hba.conf|grep -z --color=always "trust" If any lines are returned, this is a finding.

Fix: F-42396r678984_fix

Navigate to and open /storage/db/pgdata/pg_hba.conf. Find and remove the line that has a method of "trust" in the far right column. A correct, typical line will look like the following: # TYPE DATABASE USER ADDRESS METHOD host all all 127.0.0.1/32 md5

c
VMware Postgres must be configured to use TLS.
IA-5 - High - CCI-000197 - V-239205 - SV-239205r879609_rule
RMF Control
IA-5
Severity
H
CCI
CCI-000197
Version
VCPG-67-000013
Vuln IDs
  • V-239205
Rule IDs
  • SV-239205r879609_rule
The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on user ID and password may be used only when it is not possible to employ a PKI certificate. In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. VMware Postgres is configured out of the box to require TLS connections with remote clients. As an embedded database and available only on localhost for standalone VCSAs, TLS connections are used only in high-availability deployments for connections between a primary and a standby. This configuration must be verified and maintained. Satisfies: SRG-APP-000172-DB-000075, SRG-APP-000442-DB-000379
Checks: C-42438r678986_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW ssl;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: on If the output does not match the expected result, this is a finding.

Fix: F-42397r678987_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl TO 'on';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

c
VMware Postgres must enforce authorized access to all PKI private keys.
IA-5 - High - CCI-000186 - V-239206 - SV-239206r879613_rule
RMF Control
IA-5
Severity
H
CCI
CCI-000186
Version
VCPG-67-000014
Vuln IDs
  • V-239206
Rule IDs
  • SV-239206r879613_rule
The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where the DBMS-stored private keys are used to authenticate the DBMS to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man-in-the-middle attacks against the DBMS system and its clients. All access to the private key(s) of the DBMS must be restricted to authorized and authenticated users.
Checks: C-42439r678989_chk

At the command prompt, execute the following command: # stat -c "%a:%U:%G" /storage/db/vpostgres_ssl/server.key Expected result: 600:vpostgres:users If the output does not match the expected result, this is a finding.

Fix: F-42398r678990_fix

At the command prompt, execute the following commands: # chmod 600 /storage/db/vpostgres_ssl/server.key # chown vpostgres:users /storage/db/vpostgres_ssl/server.key

c
VMware Postgres must use FIPS 140-2 approved TLS ciphers.
IA-7 - High - CCI-000803 - V-239207 - SV-239207r879616_rule
RMF Control
IA-7
Severity
H
CCI
CCI-000803
Version
VCPG-67-000015
Vuln IDs
  • V-239207
Rule IDs
  • SV-239207r879616_rule
Use of weak or unvalidated cryptographic algorithms undermines the purposes of using encryption and digital signatures to protect data. Weak algorithms can be broken, and unvalidated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well as the administration settings of the DBMS. VMware Postgres does not currently implement FIPS-validated cryptographic modules. This is on the roadmap but, in the interim, Postgres can be configured with strong ciphers from the FIPS 140 approved suite. Additionally, as an embedded database and available only on localhost for standalone VCSAs, TLS connections are used only in high-availability deployments for connections between a primary and a standby. Satisfies: SRG-APP-000179-DB-000114, SRG-APP-000514-DB-000381, SRG-APP-000514-DB-000382, SRG-APP-000514-DB-000383
Checks: C-42440r678992_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW ssl_ciphers;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: !aNULL:kECDH+AES:ECDH+AES:RSA+AES:@STRENGTH If the output does not match the expected result, this is a finding.

Fix: F-42399r678993_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_ciphers TO '!aNULL:kECDH+AES:ECDH+AES:RSA+AES:@STRENGTH';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
VMware Postgres must write log entries to disk prior to returning operation success or failure.
SC-24 - Medium - CCI-001665 - V-239208 - SV-239208r879641_rule
RMF Control
SC-24
Severity
M
CCI
CCI-001665
Version
VCPG-67-000016
Vuln IDs
  • V-239208
Rule IDs
  • SV-239208r879641_rule
Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving system state information helps to facilitate system restart and return to the operational mode of the organization with less disruption of mission/business processes. Aggregating log writes saves on performance but leaves a window for log data loss. The logging system inside VMware Postgres is capable of writing logs to disk fully and completely before the associated operation is returned to the client. This ensures that database activity is always captured, even in the event of a system crash during or immediately after a given operation.
Checks: C-42441r678995_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT name,setting FROM pg_settings WHERE name IN ('fsync','full_page_writes','synchronous_commit');"|sed -n '3,5p'|sed -e 's/^[ ]*//' Expected result: fsync | on full_page_writes | on synchronous_commit | on If the output does not match the expected result, this is a finding.

Fix: F-42400r678996_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET <name> TO 'on';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();" Note: Substitute <name> with the incorrectly set parameter (fsync, full_page_writes, synchronous_commit)

b
VMware Postgres must not allow schema access to unauthorized accounts.
SC-3 - Medium - CCI-001084 - V-239209 - SV-239209r879643_rule
RMF Control
SC-3
Severity
M
CCI
CCI-001084
Version
VCPG-67-000017
Vuln IDs
  • V-239209
Rule IDs
  • SV-239209r879643_rule
Database management systems typically separate security functionality from non-security functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and non-security functionality are commingled, users who have access to non-security functionality may be able to access security functionality. VMware Postgres contains a number of system configuration schema whose access must be strictly limited. By default, the pg_catalog and information_schema objects are configured to only be accessible in a read-only manner publicly, and otherwise only accessible by the Postgres user. This configuration must be verified and maintained.
Checks: C-42442r678998_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "\dp .*.;"/opt/vmware/vpostgres/current/bin/psql -U postgres -c "\dp .*.;"|grep -E "information_schema|pg_catalog"|awk -F '|' '{print $4}'|awk -F '/' '{print $1}'|grep -v "=r"|grep -v "postgres"|grep -v " " If any lines are returned, this is a finding.

Fix: F-42401r678999_fix

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "REVOKE ALL PRIVILEGES ON <name> FROM <user>;" Replace <name> and <user> with the Access Privilege name and account, respectively, discovered during the check.

b
VMware Postgres must provide non-privileged users with minimal error information.
SI-11 - Medium - CCI-001312 - V-239211 - SV-239211r879655_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001312
Version
VCPG-67-000019
Vuln IDs
  • V-239211
Rule IDs
  • SV-239211r879655_rule
Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of error messages must contain the minimal amount of information. Databases can inadvertently provide a wealth of information to an attacker through improperly handled error messages. In addition to sensitive business or personal information, database errors can provide host names, IP addresses, user names, and other system information not required for troubleshooting but very useful to someone targeting the system. Satisfies: SRG-APP-000266-DB-000162, SRG-APP-000267-DB-000163
Checks: C-42444r679004_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW client_min_messages;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: notice If the output does not match the expected result, this is a finding.

Fix: F-42403r679005_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET client_min_messages TO 'notice';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
VMware Postgres must have log collection enabled.
AU-3 - Medium - CCI-001844 - V-239212 - SV-239212r879729_rule
RMF Control
AU-3
Severity
M
CCI
CCI-001844
Version
VCPG-67-000020
Vuln IDs
  • V-239212
Rule IDs
  • SV-239212r879729_rule
Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. VMware Postgres is capable of outputting directly to syslog but for performance reasons, the VCSA is configured to ship logs centrally via rsyslog file monitoring. To facilitate that configuration, log files must be generated to disk. Satisfies: SRG-APP-000356-DB-000314, SRG-APP-000356-DB-000315, SRG-APP-000381-DB-000361, SRG-APP-000492-DB-000333, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357, SRG-APP-000508-DB-000358, SRG-APP-000492-DB-000332, SRG-APP-000503-DB-000351, SRG-APP-000506-DB-000353
Checks: C-42445r679007_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW logging_collector;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: on If the output does not match the expected result, this is a finding.

Fix: F-42404r679008_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET logging_collector TO 'on';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
VMware Postgres must be configured to log to stderr.
AU-5 - Medium - CCI-001855 - V-239213 - SV-239213r879732_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
VCPG-67-000021
Vuln IDs
  • V-239213
Rule IDs
  • SV-239213r879732_rule
Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. For VMware Postgres logs to be successfully sent to a remote log management system, log events must be sent to stderr. Those events will be captured and logged to disk, where they will be picked up by rsyslog for shipping. Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000515-DB-000318
Checks: C-42446r679010_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW log_destination;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: stderr If the output does not match the expected result, this is a finding.

Fix: F-42405r679011_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_destination TO 'stderr';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
Rsyslog must be configured to monitor VMware Postgres logs.
AU-5 - Medium - CCI-001855 - V-239214 - SV-239214r879732_rule
RMF Control
AU-5
Severity
M
CCI
CCI-001855
Version
VCPG-67-000022
Vuln IDs
  • V-239214
Rule IDs
  • SV-239214r879732_rule
For performance reasons, rsyslog file monitoring is preferred over configuring VMware Postgres to send events to a syslog facility. Without ensuring that logs are created, that rsyslog configs are created, and that those configs are loaded, the log file monitoring and shipping will not be effective. Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000360-DB-000320, SRG-APP-000092-DB-000208
Checks: C-42447r679013_chk

At the command prompt, execute the following command: # cat /etc/vmware-syslog/stig-services-vpostgres.conf Expected result: input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.std*" Tag="vpostgres-first" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") If the file does not exist, this is a finding. If the output of the command does not match the expected result above, this is a finding. If there is no output from the command, vPostgres will default to "stderr", and this is not a finding.

Fix: F-42406r679014_fix

Navigate to and open /etc/vmware-syslog/stig-services-vpostgres.conf. Create the file if it does not exist. Set the contents of the file as follows: input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.std*" Tag="vpostgres-first" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0")

b
VMware Postgres must use Coordinated Universal Time (UTC) for log timestamps.
AU-8 - Medium - CCI-001890 - V-239215 - SV-239215r879747_rule
RMF Control
AU-8
Severity
M
CCI
CCI-001890
Version
VCPG-67-000023
Vuln IDs
  • V-239215
Rule IDs
  • SV-239215r879747_rule
If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. Time stamps generated by VMware Postgres must include date and time expressed in UTC, a modern continuation of Greenwich Mean Time (GMT).
Checks: C-42448r679016_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW log_timezone;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: Etc/UTC If the output does not match the expected result, this is a finding.

Fix: F-42407r679017_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_timezone TO 'Etc/UTC';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

b
VMware Postgres must set client-side character encoding to UTF-8.
SI-10 - Medium - CCI-002754 - V-239216 - SV-239216r879818_rule
RMF Control
SI-10
Severity
M
CCI
CCI-002754
Version
VCPG-67-000024
Vuln IDs
  • V-239216
Rule IDs
  • SV-239216r879818_rule
A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information system responses to the invalid input may be disruptive or cause the system to fail to an unsafe state.
Checks: C-42449r679019_chk

At the command prompt, execute the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SHOW client_encoding;"|sed -n 3p|sed -e 's/^[ ]*//' Expected result: UTF8 If the output does not match the expected result, this is a finding.

Fix: F-42408r679020_fix

At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET client_encoding TO 'UTF8';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"

c
The version of PostgreSQL running on the system must be a supported version.
SI-2 - High - CCI-002605 - V-257281 - SV-257281r919200_rule
RMF Control
SI-2
Severity
H
CCI
CCI-002605
Version
VCPG-67-000999
Vuln IDs
  • V-257281
Rule IDs
  • SV-257281r919200_rule
Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). This requirement will apply to software patch management solutions that are used to install patches across the enclave and to applications that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. The application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
Checks: C-60965r918881_chk

PostgreSQL 6.7 is no longer supported by the vendor. If the system is running PostgreSQL 6.7, this is a finding.

Fix: F-53958r798705_fix

Upgrade to a supported version.

b
Data from the vPostgres database must be protected from unauthorized transfer.
SC-4 - Medium - CCI-001090 - V-257296 - SV-257296r919346_rule
RMF Control
SC-4
Severity
M
CCI
CCI-001090
Version
VCPG-67-000018
Vuln IDs
  • V-257296
Rule IDs
  • SV-257296r919346_rule
Applications, including DBMSs, must prevent unauthorized and unintended information transfer via shared system resources. Data used for the development and testing of applications often involves copying data from production. It is important that specific procedures exist for this process, including the conditions under which such transfer may take place, where the copies may reside, and the rules for ensuring sensitive data is not exposed. Copies of sensitive data must not be misplaced or left in a temporary location without the proper controls.
Checks: C-60983r919346_chk

Obtain the site data-transfer policy from the ISSO. Review the policies and procedures used to ensure that all vRA data is being protected from unauthorized and unintended information transformation in accordance with site policy. If the site data-transfer policy is not followed, this is a finding.

Fix: F-60910r919342_fix

Modify any code used for moving data from production to development/test systems to comply with the organization-defined data transfer policy and to ensure that copies of production data are not left in unsecured locations.