STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter PostgreSQL service must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

DISA Rule

SV-259178r935438_rule

Vulnerability Number

V-259178

Group Title

SRG-APP-000224-DB-000384

Rule Version

VCPG-80-000049

Severity

CAT II

CCI(s)

CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.
CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.

Weight

Fix Recommendation

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl = 'on';"
# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_cert_file = '/storage/db/vpostgres_ssl/server.crt';"
# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_key_file = '/storage/db/vpostgres_ssl/server.key';"
# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_ca_file = '/storage/db/vpostgres_ssl/root_ca.pem';"

Restart the PostgreSQL service by running the following command:

# vmon-cli --restart vmware-vpostgres

Check Contents

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW ssl;"

If "ssl" is not set to "on", this is a finding.

Vulnerability Number

V-259178

Documentable

False

Rule Version

VCPG-80-000049

Severity Override Guidance

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW ssl;"

If "ssl" is not set to "on", this is a finding.

Check Content Reference

Target Key

5570