Detections
Analytics

8.3 Ensure miscellaneous configuration settings are correct

Information

This recommendation covers non-regular, special files, and dynamic libraries.

PostgreSQL permits local logins via the UNIX DOMAIN SOCKET, and anyone with a legitimate UNIX login account can make the attempt. Login attempts can be limited by relocating the UNIX DOMAIN SOCKET to a subdirectory with restricted permissions. PostgreSQL also supports user-defined dynamic libraries, whose locations are controlled by the library-related parameters addressed here.

These settings control the location of files and libraries that the PostgreSQL server trusts and executes with the privileges of the service account. If the directories referenced by the library parameters are writable by other accounts, an attacker can cause the server to load and execute arbitrary code. An unprotected UNIX DOMAIN SOCKET location widens the population of local accounts that can attempt to authenticate, and a writable external PID file can be manipulated to interfere with service management.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Follow these steps to remediate the configuration:

 - Determine permissions based on your organization's security policies.
 - Relocate files where necessary and ensure that only the PostgreSQL service account (e.g., postgres ) has access to them.
 - Ensure all directories where these files are located are accessible only by the PostgreSQL service account.
 - Change the settings accordingly in the postgresql.conf configuration file and restart the database cluster for changes to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/26344

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: PostgreSQLDB

Control ID: ee15cb0a933ada1171205454ef53df1e562ab283f26722edc2513b96f16c3eb6