PGS9-00-005500 - PostgreSQL must be able to generate audit records when privileges/permissions are retrieved.

Information

Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. PostgreSQLs typically make such information available through views or functions.

This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that PostgreSQL continually performs to determine if any and every action on the database is permitted.

Solution

Note: The following instructions use the PGDATA and PGVER environment variables. See supplementary content APPENDIX-F for instructions on configuring PGDATA and APPENDIX-H for PGVER.

Using pgaudit PostgreSQL can be configured to audit these requests. See supplementary content APPENDIX-B for documentation on installing pgaudit.

With pgaudit installed the following configurations can be made:

$ sudo su - postgres
$ vi ${PGDATA?}/postgresql.conf

Add the following parameters (or edit existing parameters):

pgaudit.log_catalog = 'on'
pgaudit.log = 'read'

Now, as the system administrator, reload the server with the new configuration:

# SYSTEMD SERVER ONLY
$ sudo systemctl reload postgresql-${PGVER?}

# INITD SERVER ONLY
$ sudo service postgresql-${PGVER?} reload

Item Details

Audit Name: DISA STIG PostgreSQL 9.x on RHEL DB v2r5

Category: AUDIT AND ACCOUNTABILITY

Plugin: PostgreSQLDB

Control ID: 25ac5e770d96c8411b2d257c13a86d81465ad34ec33d491982f6bb93a6651a62

Detections

Analytics

PGS9-00-005500 - PostgreSQL must be able to generate audit records when privileges/permissions are retrieved.

Information

Solution

See Also

Item Details