STIGQter: STIG Summary: EDB Postgres Advanced Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-213604r508024_rule

Vulnerability Number

V-213604

Group Title

SRG-APP-000231-DB-000154

Rule Version

PPS9-00-005700

Severity

CAT II

CCI(s)

• CCI-001199 - The information system protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

Create an encrypted partition to host the "<postgresql data directory>" directory. This can be done at the OS level with a technology such as db-crypt or other encryption technologies provided by third-party tools.

One option is to use LUKS as documented here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html

(The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.)

Check Contents

If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding.

Execute the following command as root:

> df

If the mounted filesystem where "<postgresql data directory>" exists is not located on an encrypted disk partition, this is a finding.  

(The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.)

Vulnerability Number

V-213604

Documentable

False

Rule Version

PPS9-00-005700

Severity Override Guidance

If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding.

Execute the following command as root:

> df

If the mounted filesystem where "<postgresql data directory>" exists is not located on an encrypted disk partition, this is a finding.  

(The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.)

Check Content Reference

M

Target Key

3988

Comments