STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 26 Jul 2023:

"Rsyslog" must be configured to monitor VMware Postgres logs.

DISA Rule

SV-256609r887613_rule

Vulnerability Number

V-256609

Group Title

SRG-APP-000359-DB-000319

Rule Version

VCPG-70-000019

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
• CCI-001855 - Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.
• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-vpostgres.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-vpostgres first logs, before loading configuration
input(type="imfile"
File="/var/log/vmware/vpostgres/serverlog.std*"
Tag="vpostgres-first"
Severity="info"
Facility="local0")
# vmware-vpostgres logs
input(type="imfile"
File="/var/log/vmware/vpostgres/postgresql-*.log"
Tag="vpostgres"
Severity="info"
Facility="local0")

Navigate to and open:

/etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf

Create the file if it does not exist.

Set the contents of the file as follows:

# vmware-postgres-archiver logs
input(type="imfile"
File="/var/log/vmware/vpostgres/pg_archiver.log.std*"
Tag="postgres-archiver"
Severity="info"
Facility="local0")

Check Contents

At the command prompt, run the following command:

# rpm -V VMware-Postgres-cis-visl-scripts|grep -E "vmware-services-vmware-vpostgres.conf|vmware-services-vmware-postgres-archiver.conf" | grep "^..5......"

If the command returns any output, this is a finding.

Vulnerability Number

V-256609

Documentable

False

Rule Version

VCPG-70-000019

Severity Override Guidance

At the command prompt, run the following command:

# rpm -V VMware-Postgres-cis-visl-scripts|grep -E "vmware-services-vmware-vpostgres.conf|vmware-services-vmware-postgres-archiver.conf" | grep "^..5......"

If the command returns any output, this is a finding.

Check Content Reference

M

Target Key

5521