STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter PostgreSQL service must be configured to protect log files from unauthorized access.

DISA Rule

SV-259172r935420_rule

Vulnerability Number

V-259172

Group Title

SRG-APP-000118-DB-000059

Rule Version

VCPG-80-000020

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.

Weight

10

Fix Recommendation

A script is included with vCenter to generate a PostgreSQL STIG configuration.

At the command prompt, run the following commands:

# chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py
# /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres
# chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py

Restart the PostgreSQL service by running the following command:

# vmon-cli --restart vmware-vpostgres

At the command prompt, run the following commands:

# chmod 600 <file>
# chown vpostgres:vpgmongrp <file>

Note: Replace <file> with the file that has incorrect permissions.

Check Contents

Verify the default log file permissions and permissions on existing log files.

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_file_mode;"

Expected result:

0600

If "log_file_mode" is not set to "0600", this is a finding.

At the command prompt, run the following command:

# find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \;

If any files are returned, this is a finding.

Vulnerability Number

V-259172

Documentable

False

Rule Version

VCPG-80-000020

Severity Override Guidance

Verify the default log file permissions and permissions on existing log files.

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_file_mode;"

Expected result:

0600

If "log_file_mode" is not set to "0600", this is a finding.

At the command prompt, run the following command:

# find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \;

If any files are returned, this is a finding.

Check Content Reference

M

Target Key

5570