Detections
Analytics

7.3 Ensure base backups are configured and functional1

Information

A 'base backup' is a copy of the PRIMARY host's data cluster ( $PGDATA ) and is used to create STANDBY hosts and for Point In Time Recovery (PITR) mechanisms. Base backups should be copied across networks in a secure manner using an encrypted transport mechanism. The PostgreSQL CLI pg_basebackup utility included with PostgreSQL can be used; however, TLS encryption should be enabled on the server as per section 6.8 of this benchmark. The pgBackRest tool detailed in section 8.2 of this benchmark can also be used to create a 'base backup'.

A data cluster that cannot be restored represents a total loss of the data it contains. Without current, functional base backups, data lost to hardware failure, corruption, or accidental or malicious destruction, including ransomware, cannot be recovered, and neither Point In Time Recovery nor the creation of standby hosts is possible. Because a base backup contains the entire data cluster, transferring it without encryption would expose all of its data to interception on the network.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

For example, executing base backups using pg_basebackup requires the following steps on the standby server:

$ whoami
postgres
$ pg_basebackup --host=name_or_IP_of_master \
--port=5432 \
--username=replication_user \
--pgdata=~postgres/17/data \
--progress --verbose --write-recovery-conf --wal-method=stream

See Also

https://workbench.cisecurity.org/benchmarks/26344

Item Details

Category: CONTINGENCY PLANNING

References: 800-53|CP-4, 800-53|CP-9(1), CSCv7|10.3

Plugin: Unix

Control ID: f60a53d33cf1f40667b5073d8a0bf6cdd5dbd7f48c6e5fcdadebc98ad0a21409