Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW max_connections;" If the returned number is not greater than or equal to 100 and less than or equal to 1000, this is a finding.
At the command prompt, run the following command: # vmon-cli --restart vmware-vpostgres Note: Restarting the service runs the "pg_tuning" script that will configure "max_connections" to the appropriate value based on the allocated memory for vCenter.
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW shared_preload_libraries;" Example result: health_status_worker,pg_stat_statements,pgaudit If the output from the command does not include pgaudit, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # find /storage/db/vpostgres/*conf* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \; If any files are returned, this is a finding.
At the command prompt, run the following commands: # chmod 600 <file> # chown vpostgres:vpgmongrp <file> Note: Replace <file> with the file that has incorrect permissions.
At the command prompt, run the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_catalog;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_parameter;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_statement_once;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_level;" If "pgaudit.log_catalog" is not set to "on", this is a finding. If "pgaudit.log" is not set to "all, -misc", this is a finding. If "pgaudit.log_parameter" is not set to "on", this is a finding. If "pgaudit.log_statement_once" is not set to "off", this is a finding. If "pgaudit.log_level" is not set to "log", this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_destination;" Example result: stderr If "log_destination" is not set to "stderr" or "syslog", this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_line_prefix;" Expected result: %m %c %x %d %u %r %p %l If the output does not include each option in the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
Verify the default log file permissions and permissions on existing log files. At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_file_mode;" Expected result: 0600 If "log_file_mode" is not set to "0600", this is a finding. At the command prompt, run the following command: # find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \; If any files are returned, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres At the command prompt, run the following commands: # chmod 600 <file> # chown vpostgres:vpgmongrp <file> Note: Replace <file> with the file that has incorrect permissions.
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "select * from pg_extension where extname != 'plpgsql'" If any extensions are output, this is a finding.
At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -c "DROP EXTENSION <extension name>" Note: It is recommended that plpgsql not be removed.
At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW port;" Expected result: 5432 If the output does not match the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # grep -v "^#" /storage/db/vpostgres/pg_hba.conf |grep '\S' If any lines are returned contain "trust" or "password" as an auth-method, this is a finding.
Navigate to and open: /storage/db/vpostgres/pg_hba.conf Find and update any line that has a method of "trust" or "password" in the far-right column. A correct, typical line will look like the below: # TYPE DATABASE USER ADDRESS METHOD local VCDB vpxd peer map=vcdb Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW password_encryption;" Expected result: scram-sha-256 If the output does not match the expected result, this is a finding. Note: Prior to Update 2, "md5" is the expected result.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # stat -c "%n is owned by %U:%G with permissions of %a" /storage/db/vpostgres_ssl/server.key Example output: /storage/db/vpostgres_ssl/server.key is owned by vpostgres:vpgmongrp with permissions of 600 If the SSL key file is not owned by the user vpostgres and group vpgmongrp, this is a finding. If the SSL key file has permissions more permissive than 0600, this is a finding.
At the command prompt, enter the following commands: # chmod 600 /storage/db/vpostgres_ssl/server.key # chown vpostgres:vpgmongrp /storage/db/vpostgres_ssl/server.key
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW ssl;" If "ssl" is not set to "on", this is a finding.
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl = 'on';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_cert_file = '/storage/db/vpostgres_ssl/server.crt';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_key_file = '/storage/db/vpostgres_ssl/server.key';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_ca_file = '/storage/db/vpostgres_ssl/root_ca.pem';" Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SELECT name,setting FROM pg_settings WHERE name IN ('fsync','full_page_writes','synchronous_commit');" Expected result: fsync | on full_page_writes | on synchronous_commit | on If the output does not match the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW client_min_messages;" Expected result: error If the output does not match the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW logging_collector;" Expected result: on If the output does not match the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_timezone;" Expected result: UTC If the output does not match the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_connections;" Expected result: on If the output does not match the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_disconnections;" Expected result: on If the output does not match the expected result, this is a finding.
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres
By default there is a vmware-services-vmware-vpostgres.conf rsyslog and vmware-services-vmware-postgres-archiver.conf configuration file that includes the service logs when syslog is configured on vCenter but it must be verified. At the command prompt, run the following command: # cat /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Expected result: # vmware-vpostgres first logs stdout, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stdout" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres first logs stderr, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stderr" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") If the output does not match the expected result, this is a finding. At the command prompt, run the following command: # cat /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Expected result: # vmware-postgres-archiver stdout log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stdout" Tag="postgres-archiver" Severity="info" Facility="local0") # vmware-postgres-archiver stderr log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stderr" Tag="postgres-archiver" Severity="info" Facility="local0") If the output does not match the expected result, this is a finding.
Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-vpostgres first logs stdout, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stdout" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres first logs stderr, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stderr" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-postgres-archiver stdout log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stdout" Tag="postgres-archiver" Severity="info" Facility="local0") # vmware-postgres-archiver stderr log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stderr" Tag="postgres-archiver" Severity="info" Facility="local0")