Detections
Analytics

7.2 Ensure logging of replication commands is configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enabling the log_replication_commands setting causes each attempted replication from the server to be logged.

A successful replication connection allows for a complete copy of the data stored within the data cluster to be offloaded to another, potentially insecure, host. As such, it is advisable to log all replication commands that are executed in your database cluster to ensure the data is not off-loaded to an unexpected/undesired location.

Solution

To enable the logging of replication commands, execute the following:

postgres=# ALTER SYSTEM SET log_replication_commands = 'on';
ALTER SYSTEM
postgres=# SELECT pg_reload_conf();
 pg_reload_conf
----------------
 t
(1 row)
postgres=# SHOW log_replication_commands ;
 log_replication_commands
--------------------------
 on
(1 row)

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|4.3

Plugin: PostgreSQLDB

Control ID: 7c4e61a7d36d12f62b006bc6c5df4fdf4861762c50e1b82f6ca03bad3b03e785