STIGQter: STIG Summary: EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The EDB Postgres Advanced Server must separate user functionality (including user interface services) from database management functionality.

DISA Rule

SV-224176r508023_rule

Vulnerability Number

V-224176

Group Title

SRG-APP-000211-DB-000122

Rule Version

EP11-00-005100

Severity

CAT II

CCI(s)

• CCI-001082 - The information system separates user functionality (including user interface services) from information system management functionality.

Weight

10

Fix Recommendation

Configure EDB Postgres Advanced Server to separate database administration and general user functionality.

Use the ALTER ROLE SQL command to remove "SUPERUSER", "CREATE Role", "Create DB", or "Bypass RLS" privileges from user and group roles that are not authorized for those roles.

For example:

ALTER ROLE <username> NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;

Check Contents

Check EDB Postgres Advanced Server permission settings to verify that administrative functionality is kept separate from user functionality.

As a database superuser user (e.g., enterprisedb), list the user and group roles and their permissions in an EDB Postgres Advanced Server instance; execute the following command in psql:

\du

If any non-administrative role has the attribute "Superuser", "Create role", "Create DB" or "Bypass RLS", this is a finding.

If administrator and general user functionality is not separated either physically or logically, this is a finding.

Vulnerability Number

V-224176

Documentable

False

Rule Version

EP11-00-005100

Severity Override Guidance

Check EDB Postgres Advanced Server permission settings to verify that administrative functionality is kept separate from user functionality.

As a database superuser user (e.g., enterprisedb), list the user and group roles and their permissions in an EDB Postgres Advanced Server instance; execute the following command in psql:

\du

If any non-administrative role has the attribute "Superuser", "Create role", "Create DB" or "Bypass RLS", this is a finding.

If administrator and general user functionality is not separated either physically or logically, this is a finding.

Check Content Reference

M

Target Key

4107

Comments