Detections
Analytics

6.4 Ensure 'SIGHUP' Runtime Parameters are Configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

PostgreSQL runtime parameters that are executed by the SIGHUP signal.

In order to define server behavior and optimize server performance, the server's superuser has the privilege of setting these parameters which are found in the configuration files postgresql.conf and pg_hba.conf Alternatively, those parameters found in postgresql.conf can also be changed using a server login session and executing the SQL command ALTER SYSTEM which writes its changes in the configuration file postgresql.auto.conf

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Restore all values in the PostgreSQL configuration files and invoke the server to reload the configuration files.

Impact:

All changes made on this level will affect the overall behavior of the server. These changes can be effected by editing the PostgreSQL configuration files and by either executing a server SIGHUP from the command line or, as superuser postgres executing the SQL command select pg_reload_conf() A denial of service is possible by the over-allocating of limited resources, such as RAM. Data can be corrupted by allowing damaged pages to load or by changing parameters to reinterpret values in an unexpected fashion, e.g. changing the time zone. Client messages can be altered in such a way as to interfere with the application logic. Logging can be altered and obfuscated inhibiting root cause analysis.

See Also

https://workbench.cisecurity.org/benchmarks/19478

Item Details

References: CSCv7|18.11

Plugin: PostgreSQLDB

Control ID: 4ca78255e5710e23aef10fc4952cd9fe95339bf6cb220ceba3ad06a5245f53ad