Detections
Analytics

PPS9-00-001200 - The EDB Postgres Advanced Server must generate audit records when privileges/permissions are retrieved.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions.

This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that the DBMS continually performs to determine if any and every action on the database is permitted.

Solution

Execute the following SQL as enterprisedb:

ALTER SYSTEM SET edb_audit_statement = 'all';
SELECT pg_reload_conf();

or

Update the system documentation to note the organizationally approved setting and corresponding justification of the setting for this requirement.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_EDB_PGS_Advanced_Server_V2R2_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000172, Rule-ID|SV-213567r508024_rule, STIG-ID|PPS9-00-001200, STIG-Legacy|SV-83491, STIG-Legacy|V-68887, Vuln-ID|V-213567

Plugin: PostgreSQLDB

Control ID: 149eca66f184e9f27feb78750b8f661569732caf3fab514a17d1bbcdbf02c0fc