STIGQter STIGQter: STIG Summary: Crunchy Data PostgreSQL Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

PostgreSQL must enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).

DISA Rule

SV-233597r617333_rule

Vulnerability Number

V-233597

Group Title

SRG-APP-000380-DB-000360

Rule Version

CD12-00-009600

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure PostgreSQL to enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).

Use ALTER ROLE to remove accesses from roles:

$ psql -c "ALTER ROLE <role_name> NOSUPERUSER"

Use REVOKE to remove privileges from databases and schemas:

$ psql -c "REVOKE ALL PRIVILEGES ON <table> FROM <role_name>"

Check Contents

To list all the permissions of individual roles, as the database administrator (shown here as "postgres"), run the following SQL:

$ sudo su - postgres
$ psql -c "\du

If any role has SUPERUSER that should not, this is a finding.

Next, list all the permissions of databases and schemas by running the following SQL:

$ sudo su - postgres
$ psql -c "\l"
$ psql -c "\dn+"

If any database or schema has update ("W") or create ("C") privileges and should not, this is a finding.

Vulnerability Number

V-233597

Documentable

False

Rule Version

CD12-00-009600

Severity Override Guidance

To list all the permissions of individual roles, as the database administrator (shown here as "postgres"), run the following SQL:

$ sudo su - postgres
$ psql -c "\du

If any role has SUPERUSER that should not, this is a finding.

Next, list all the permissions of databases and schemas by running the following SQL:

$ sudo su - postgres
$ psql -c "\l"
$ psql -c "\dn+"

If any database or schema has update ("W") or create ("C") privileges and should not, this is a finding.

Check Content Reference

M

Target Key

5254

Comments