STIGQter STIGQter: STIG Summary: PostgreSQL 9.x Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

PostgreSQL must reveal detailed error messages only to the ISSO, ISSM, SA and DBA.

DISA Rule

SV-214070r548749_rule

Vulnerability Number

V-214070

Group Title

SRG-APP-000267-DB-000163

Rule Version

PGS9-00-002500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA.

To set the level of detail for errors messages exposed to clients, as the database administrator (shown here as "postgres"), run the following commands:

$ sudo su - postgres
$ vi ${PGDATA?}/postgresql.conf
client_min_messages = error

Check Contents

Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA. 

Check PostgreSQL settings and custom database code to determine if detailed error messages are ever displayed to unauthorized individuals. 

To check the level of detail for errors exposed to clients, as the database administrator (shown here as "postgres"), run the following: 

$ sudo su - postgres 
$ grep "client_min_messages" ${PGDATA?}/postgresql.conf 

If client_min_messages is set to LOG or DEBUG, this is a finding. 

If detailed error messages are displayed to individuals not authorized to view them, this is a finding. 

#### stderr Logging 

Logs may contain detailed information and should only be accessible by the database owner. 

As the database administrator, verify the following settings of logs in the postgresql.conf file. 

Note: Consult the organization's documentation on acceptable log privileges 

$ sudo su - postgres 
$ grep log_directory ${PGDATA?}/postgresql.conf 
$ grep log_file_mode ${PGDATA?}/postgresql.conf 

Next, verify the log files have the set configurations. 

Note: Use location of logs from log_directory. 

$ ls -l <audit_log_path> 
total 32 
-rw-------. 1 postgres postgres 0 Apr 8 00:00 postgresql-Fri.log 
-rw-------. 1 postgres postgres 8288 Apr 11 17:36 postgresql-Mon.log 
-rw-------. 1 postgres postgres 0 Apr 9 00:00 postgresql-Sat.log 
-rw-------. 1 postgres postgres 0 Apr 10 00:00 postgresql-Sun.log 
-rw-------. 1 postgres postgres 16212 Apr 7 17:05 postgresql-Thu.log 
-rw-------. 1 postgres postgres 1130 Apr 6 17:56 postgresql-Wed.log 

If logs are not owned by the database administrator or have permissions that are not 0600, this is a finding. 

#### syslog Logging 

If PostgreSQL is configured to use syslog for logging, consult organization location and permissions for syslog log files. If the logs are not owned by root or have permissions that are not 0600, this is a finding.

Vulnerability Number

V-214070

Documentable

False

Rule Version

PGS9-00-002500

Severity Override Guidance

Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA. 

Check PostgreSQL settings and custom database code to determine if detailed error messages are ever displayed to unauthorized individuals. 

To check the level of detail for errors exposed to clients, as the database administrator (shown here as "postgres"), run the following: 

$ sudo su - postgres 
$ grep "client_min_messages" ${PGDATA?}/postgresql.conf 

If client_min_messages is set to LOG or DEBUG, this is a finding. 

If detailed error messages are displayed to individuals not authorized to view them, this is a finding. 

#### stderr Logging 

Logs may contain detailed information and should only be accessible by the database owner. 

As the database administrator, verify the following settings of logs in the postgresql.conf file. 

Note: Consult the organization's documentation on acceptable log privileges 

$ sudo su - postgres 
$ grep log_directory ${PGDATA?}/postgresql.conf 
$ grep log_file_mode ${PGDATA?}/postgresql.conf 

Next, verify the log files have the set configurations. 

Note: Use location of logs from log_directory. 

$ ls -l <audit_log_path> 
total 32 
-rw-------. 1 postgres postgres 0 Apr 8 00:00 postgresql-Fri.log 
-rw-------. 1 postgres postgres 8288 Apr 11 17:36 postgresql-Mon.log 
-rw-------. 1 postgres postgres 0 Apr 9 00:00 postgresql-Sat.log 
-rw-------. 1 postgres postgres 0 Apr 10 00:00 postgresql-Sun.log 
-rw-------. 1 postgres postgres 16212 Apr 7 17:05 postgresql-Thu.log 
-rw-------. 1 postgres postgres 1130 Apr 6 17:56 postgresql-Wed.log 

If logs are not owned by the database administrator or have permissions that are not 0600, this is a finding. 

#### syslog Logging 

If PostgreSQL is configured to use syslog for logging, consult organization location and permissions for syslog log files. If the logs are not owned by root or have permissions that are not 0600, this is a finding.

Check Content Reference

M

Target Key

3994

Comments