Detections
Analytics

6.6 Ensure 'User' Runtime Parameters are Configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

These PostgreSQL runtime parameters are managed at the user account (ROLE) level.

In order to improve performance and optimize features, a ROLE has the privilege of setting numerous parameters in a transaction, session, or entity attribute. Any ROLE can alter any of these parameters.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

In the matter of a user session, the login sessions must be validated that it is not executing undesired parameter changes. In the matter of attributes that have been changed in entities, they must be manually reverted to their default value(s).

Impact:

A denial of service is possible by the over-allocating of limited resources, such as RAM. Changing VACUUM parameters can force a server shutdown which is standard procedure preventing data corruption from transaction ID wraparound. Data can be corrupted by changing parameters to reinterpret values in an unexpected fashion, e.g. changing the time zone. Logging can be altered and obfuscated to inhibit root cause analysis.

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|18.11

Plugin: PostgreSQLDB

Control ID: 3e1af75f33e4733502419b84e4c28b716c16b8fac886ece6596e5dd11fd0ce90