VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide

  • Version/Release: V1R1
  • Published: 2023-10-29
  • Released: 2023-10-31
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
b
The vCenter PostgreSQL service must limit the number of concurrent sessions.
AC-10 - Medium - CCI-000054 - V-259166 - SV-259166r935402_rule
RMF Control
AC-10
Severity
Medium
CCI
CCI-000054
Version
VCPG-80-000001
Vuln IDs
  • V-259166
Rule IDs
  • SV-259166r935402_rule
Database management includes the ability to control the number of users and user sessions utilizing a database management system (DBMS). Unlimited concurrent connections to the DBMS could allow a successful denial-of-service (DoS) attack by exhausting connection resources, and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. VMware Postgres as deployed on the vCenter Service Appliance (VCSA) comes preconfigured with a "max_connections" limit that is appropriate for all tested, supported scenarios. The out-of-the-box configuration is dynamic, based on a lower limit plus allowances for the resources assigned to VCSA and the deployment size. However, this number will always be between 100 and 1000 (inclusive).
Checks: C-62906r935400_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW max_connections;" If the returned number is not greater than or equal to 100 and less than or equal to 1000, this is a finding.

Fix: F-62815r935401_fix

At the command prompt, run the following command: # vmon-cli --restart vmware-vpostgres Note: Restarting the service runs the "pg_tuning" script that will configure "max_connections" to the appropriate value based on the allocated memory for vCenter.

b
The vCenter PostgreSQL service must enable "pgaudit" to provide audit record generation capabilities.
AU-12 - Medium - CCI-000169 - V-259167 - SV-259167r935405_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000169
Version
VCPG-80-000005
Vuln IDs
  • V-259167
Rule IDs
  • SV-259167r935405_rule
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the database management system (DBMS) (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DOD has defined the list of events for which the DBMS will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions. Organizations may define additional events requiring continuous or ad hoc auditing.
Checks: C-62907r935403_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW shared_preload_libraries;" Example result: health_status_worker,pg_stat_statements,pgaudit If the output from the command does not include pgaudit, this is a finding.

Fix: F-62816r935404_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service configuration files must not be accessible by unauthorized users.
AU-12 - Medium - CCI-000171 - V-259168 - SV-259168r935408_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000171
Version
VCPG-80-000006
Vuln IDs
  • V-259168
Rule IDs
  • SV-259168r935408_rule
Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. Suppression of auditing could permit an adversary to evade detection. Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-APP-000090-DB-000065, SRG-APP-000121-DB-000202, SRG-APP-000122-DB-000203, SRG-APP-000123-DB-000204, SRG-APP-000380-DB-000360
Checks: C-62908r935406_chk

At the command prompt, run the following command: # find /storage/db/vpostgres/*conf* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Fix: F-62817r935407_fix

At the command prompt, run the following commands: # chmod 600 <file> # chown vpostgres:vpgmongrp <file> Note: Replace <file> with the file that has incorrect permissions.

b
The vCenter PostgreSQL service must generate audit records.
AU-12 - Medium - CCI-000172 - V-259169 - SV-259169r935411_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
VCPG-80-000007
Vuln IDs
  • V-259169
Rule IDs
  • SV-259169r935411_rule
Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. Database management systems (DBMS) typically make such information available through views or functions. This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that PostgreSQL continually performs to determine if any and every action on the database is permitted. Satisfies: SRG-APP-000091-DB-000066, SRG-APP-000091-DB-000325, SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357
Checks: C-62909r935409_chk

At the command prompt, run the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_catalog;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_parameter;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_statement_once;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_level;" If "pgaudit.log_catalog" is not set to "on", this is a finding. If "pgaudit.log" is not set to "all, -misc", this is a finding. If "pgaudit.log_parameter" is not set to "on", this is a finding. If "pgaudit.log_statement_once" is not set to "off", this is a finding. If "pgaudit.log_level" is not set to "log", this is a finding.

Fix: F-62818r935410_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must initiate session auditing upon startup.
AU-14 - Medium - CCI-001464 - V-259170 - SV-259170r935414_rule
RMF Control
AU-14
Severity
Medium
CCI
CCI-001464
Version
VCPG-80-000009
Vuln IDs
  • V-259170
Rule IDs
  • SV-259170r935414_rule
Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time the database management system (DBMS) is running.
Checks: C-62910r935412_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_destination;" Example result: stderr If "log_destination" is not set to "stderr" or "syslog", this is a finding.

Fix: F-62819r935413_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred.
AU-3 - Medium - CCI-000130 - V-259171 - SV-259171r935417_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
VCPG-80-000010
Vuln IDs
  • V-259171
Rule IDs
  • SV-259171r935417_rule
Information system auditing capability is critical for accurate forensic analysis. Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit record content that may be necessary to satisfy the requirement of this policy includes, for example, time stamps, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application. Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly what actions were performed. This requires specific information regarding the event type an audit record is referring to. If event type information is not recorded and stored with the audit record, the record itself is of very limited use. Satisfies: SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000375-DB-000323
Checks: C-62911r935415_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_line_prefix;" Expected result: %m %c %x %d %u %r %p %l If the output does not include each option in the expected result, this is a finding.

Fix: F-62820r935416_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must be configured to protect log files from unauthorized access.
AU-9 - Medium - CCI-000162 - V-259172 - SV-259172r935420_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-000162
Version
VCPG-80-000020
Vuln IDs
  • V-259172
Rule IDs
  • SV-259172r935420_rule
If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061
Checks: C-62912r935418_chk

Verify the default log file permissions and permissions on existing log files. At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_file_mode;" Expected result: 0600 If "log_file_mode" is not set to "0600", this is a finding. At the command prompt, run the following command: # find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Fix: F-62821r935419_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres At the command prompt, run the following commands: # chmod 600 <file> # chown vpostgres:vpgmongrp <file> Note: Replace <file> with the file that has incorrect permissions.

b
The vCenter PostgreSQL service must not load unused database components, software, and database objects.
CM-7 - Medium - CCI-000381 - V-259173 - SV-259173r935423_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCPG-80-000032
Vuln IDs
  • V-259173
Rule IDs
  • SV-259173r935423_rule
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Database management systems (DBMS) must adhere to the principles of least functionality by providing only essential capabilities. Satisfies: SRG-APP-000141-DB-000091, SRG-APP-000141-DB-000093
Checks: C-62913r935421_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "select * from pg_extension where extname != 'plpgsql'" If any extensions are output, this is a finding.

Fix: F-62822r935422_fix

At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -c "DROP EXTENSION <extension name>" Note: It is recommended that plpgsql not be removed.

b
The vCenter PostgreSQL service must be configured to use an authorized port.
CM-7 - Medium - CCI-000382 - V-259174 - SV-259174r935426_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000382
Version
VCPG-80-000035
Vuln IDs
  • V-259174
Rule IDs
  • SV-259174r935426_rule
In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols/services on information systems. Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. Database Management Systems using ports, protocols, and services deemed unsafe are open to attack through those ports, protocols, and services. This can allow unauthorized access to the database and through the database to other components of the information system. Satisfies: SRG-APP-000142-DB-000094, SRG-APP-000383-DB-000364
Checks: C-62914r935424_chk

At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW port;" Expected result: 5432 If the output does not match the expected result, this is a finding.

Fix: F-62823r935425_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must require authentication on all connections.
IA-5 - Medium - CCI-000197 - V-259175 - SV-259175r935429_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-000197
Version
VCPG-80-000036
Vuln IDs
  • V-259175
Rule IDs
  • SV-259175r935429_rule
To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: (i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and (ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity. Satisfies: SRG-APP-000148-DB-000103, SRG-APP-000172-DB-000075
Checks: C-62915r935427_chk

At the command prompt, run the following command: # grep -v "^#" /storage/db/vpostgres/pg_hba.conf |grep '\S' If any lines are returned contain "trust" or "password" as an auth-method, this is a finding.

Fix: F-62824r935428_fix

Navigate to and open: /storage/db/vpostgres/pg_hba.conf Find and update any line that has a method of "trust" or "password" in the far-right column. A correct, typical line will look like the below: # TYPE DATABASE USER ADDRESS METHOD local VCDB vpxd peer map=vcdb Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

c
The vCenter PostgreSQL service must encrypt passwords for user authentication.
IA-5 - High - CCI-000196 - V-259176 - SV-259176r935432_rule
RMF Control
IA-5
Severity
High
CCI
CCI-000196
Version
VCPG-80-000038
Vuln IDs
  • V-259176
Rule IDs
  • SV-259176r935432_rule
The DOD standard for authentication is DOD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate and requires AO approval. In such cases, database passwords stored in clear text, using reversible encryption, or using unsalted hashes would be vulnerable to unauthorized disclosure. Database passwords must always be in the form of one-way, salted hashes when stored internally or externally to the database management system (DBMS).
Checks: C-62916r935430_chk

At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW password_encryption;" Expected result: scram-sha-256 If the output does not match the expected result, this is a finding. Note: Prior to Update 2, "md5" is the expected result.

Fix: F-62825r935431_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

c
The vCenter PostgreSQL service must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL.
IA-5 - High - CCI-000186 - V-259177 - SV-259177r935435_rule
RMF Control
IA-5
Severity
High
CCI
CCI-000186
Version
VCPG-80-000041
Vuln IDs
  • V-259177
Rule IDs
  • SV-259177r935435_rule
The DOD standard for authentication is DOD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where the database management system (DBMS)-stored private keys are used to authenticate the DBMS to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against the DBMS system and its clients. Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules. All access to the private key(s) of the DBMS must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of the DBMS's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.
Checks: C-62917r935433_chk

At the command prompt, run the following command: # stat -c "%n is owned by %U:%G with permissions of %a" /storage/db/vpostgres_ssl/server.key Example output: /storage/db/vpostgres_ssl/server.key is owned by vpostgres:vpgmongrp with permissions of 600 If the SSL key file is not owned by the user vpostgres and group vpgmongrp, this is a finding. If the SSL key file has permissions more permissive than 0600, this is a finding.

Fix: F-62826r935434_fix

At the command prompt, enter the following commands: # chmod 600 /storage/db/vpostgres_ssl/server.key # chown vpostgres:vpgmongrp /storage/db/vpostgres_ssl/server.key

b
The vCenter PostgreSQL service must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.
SC-23 - Medium - CCI-001188 - V-259178 - SV-259178r935438_rule
RMF Control
SC-23
Severity
Medium
CCI
CCI-001188
Version
VCPG-80-000049
Vuln IDs
  • V-259178
Rule IDs
  • SV-259178r935438_rule
One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 approved random number generator. However, it is recognized that available database management system (DBMS) products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective. Satisfies: SRG-APP-000224-DB-000384, SRG-APP-000441-DB-000378, SRG-APP-000442-DB-000379
Checks: C-62918r935436_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW ssl;" If "ssl" is not set to "on", this is a finding.

Fix: F-62827r935437_fix

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl = 'on';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_cert_file = '/storage/db/vpostgres_ssl/server.crt';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_key_file = '/storage/db/vpostgres_ssl/server.key';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_ca_file = '/storage/db/vpostgres_ssl/root_ca.pem';" Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must write log entries to disk prior to returning operation success or failure.
SC-24 - Medium - CCI-001665 - V-259179 - SV-259179r935441_rule
RMF Control
SC-24
Severity
Medium
CCI
CCI-001665
Version
VCPG-80-000051
Vuln IDs
  • V-259179
Rule IDs
  • SV-259179r935441_rule
Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving system state information helps to facilitate system restart and return to the operational mode of the organization with less disruption of mission/business processes. Aggregating log writes saves on performance but leaves a window for log data loss. The logging system inside PostgreSQL is capable of writing logs to disk, fully and completely before the associated operation is returned to the client. This ensures that database activity is always captured, even in the event of a system crash during or immediately after a given operation.
Checks: C-62919r935439_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SELECT name,setting FROM pg_settings WHERE name IN ('fsync','full_page_writes','synchronous_commit');" Expected result: fsync | on full_page_writes | on synchronous_commit | on If the output does not match the expected result, this is a finding.

Fix: F-62828r935440_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must provide nonprivileged users with minimal error information.
SI-11 - Medium - CCI-001312 - V-259180 - SV-259180r935444_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001312
Version
VCPG-80-000060
Vuln IDs
  • V-259180
Rule IDs
  • SV-259180r935444_rule
Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of error messages need to contain the minimal amount of information. Databases can inadvertently provide a wealth of information to an attacker through improperly handled error messages. In addition to sensitive business or personal information, database errors can provide host names, IP addresses, usernames, and other system information not required for troubleshooting but very useful to someone targeting the system. Satisfies: SRG-APP-000266-DB-000162, SRG-APP-000267-DB-000163
Checks: C-62920r935442_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW client_min_messages;" Expected result: error If the output does not match the expected result, this is a finding.

Fix: F-62829r935443_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must have log collection enabled.
CM-5 - Medium - CCI-001814 - V-259181 - SV-259181r935447_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001814
Version
VCPG-80-000070
Vuln IDs
  • V-259181
Rule IDs
  • SV-259181r935447_rule
Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Satisfies: SRG-APP-000356-DB-000314, SRG-APP-000381-DB-000361
Checks: C-62921r935445_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW logging_collector;" Expected result: on If the output does not match the expected result, this is a finding.

Fix: F-62830r935446_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must use Coordinated Universal Time (UTC) for log timestamps.
AU-8 - Medium - CCI-001890 - V-259182 - SV-259182r935450_rule
RMF Control
AU-8
Severity
Medium
CCI
CCI-001890
Version
VCPG-80-000075
Vuln IDs
  • V-259182
Rule IDs
  • SV-259182r935450_rule
If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. Time stamps generated by PostgreSQL must include date and time. Time is commonly expressed in UTC, a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.
Checks: C-62922r935448_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_timezone;" Expected result: UTC If the output does not match the expected result, this is a finding.

Fix: F-62831r935449_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must log all connection attempts.
AU-12 - Medium - CCI-000172 - V-259183 - SV-259183r935453_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
VCPG-80-000110
Vuln IDs
  • V-259183
Rule IDs
  • SV-259183r935453_rule
For completeness of forensic analysis, it is necessary to track successful and failed attempts to log on to PostgreSQL. Setting "log_connections" to "on" will cause each attempted connection to the server to be logged, as well as successful completion of client authentication. Satisfies: SRG-APP-000503-DB-000350, SRG-APP-000503-DB-000351, SRG-APP-000506-DB-000353, SRG-APP-000508-DB-000358
Checks: C-62923r935451_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_connections;" Expected result: on If the output does not match the expected result, this is a finding.

Fix: F-62832r935452_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must log all client disconnections.
AU-12 - Medium - CCI-000172 - V-259184 - SV-259184r935456_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000172
Version
VCPG-80-000114
Vuln IDs
  • V-259184
Rule IDs
  • SV-259184r935456_rule
Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged. For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to PostgreSQL lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs.
Checks: C-62924r935454_chk

At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_disconnections;" Expected result: on If the output does not match the expected result, this is a finding.

Fix: F-62833r935455_fix

A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres

b
The vCenter PostgreSQL service must off-load audit data to a separate log management facility.
AU-4 - Medium - CCI-001851 - V-259185 - SV-259185r935459_rule
RMF Control
AU-4
Severity
Medium
CCI
CCI-001851
Version
VCPG-80-000122
Vuln IDs
  • V-259185
Rule IDs
  • SV-259185r935459_rule
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. The database management system (DBMS) may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.
Checks: C-62925r935457_chk

By default there is a vmware-services-vmware-vpostgres.conf rsyslog and vmware-services-vmware-postgres-archiver.conf configuration file that includes the service logs when syslog is configured on vCenter but it must be verified. At the command prompt, run the following command: # cat /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Expected result: # vmware-vpostgres first logs stdout, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stdout" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres first logs stderr, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stderr" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") If the output does not match the expected result, this is a finding. At the command prompt, run the following command: # cat /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Expected result: # vmware-postgres-archiver stdout log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stdout" Tag="postgres-archiver" Severity="info" Facility="local0") # vmware-postgres-archiver stderr log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stderr" Tag="postgres-archiver" Severity="info" Facility="local0") If the output does not match the expected result, this is a finding.

Fix: F-62834r935458_fix

Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-vpostgres first logs stdout, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stdout" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres first logs stderr, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stderr" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-postgres-archiver stdout log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stdout" Tag="postgres-archiver" Severity="info" Facility="local0") # vmware-postgres-archiver stderr log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stderr" Tag="postgres-archiver" Severity="info" Facility="local0")