V1R2 changes
VMware vSphere 6.7 PostgreSQL STIG V1R2 (2023-07-26) replaced V1R1 (2021-03-09): 2 checks added, 2 removed, 19 updated. It has 22 checks, against 22 in V1R1.
V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare
- 2 added
- 2 removed
- 19 updated
Updated fields: Discussion 19
Added in V1R2 (2)
Removed since V1R1 (2)
Updated in V1R2 (19)
V-239196CAT IIVMware Postgres must limit the number of connections.Discussion
Discussion
Database management includes the ability to control the number of users and user sessions utilizing a DBMS. Unlimited concurrent connections to the DBMS could allow a successful denial-of-service (DoS) attack by exhausting connection resources, and a system couldcan also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks.
ThisVMware requirementPostgres addressesas concurrentdeployed sessionon controlthe forVCSA acomes singlepreconfigured account.with It does not address concurrent sessions by a singlemax_connections user via multiple system accounts and does not deal with the total number of sessions across all accounts.
The capability to limit the number of concurrent sessions per user must be configured in or added to the DBMS (for example, by use of a logon trigger) when this is technically feasible. Note that it is notappropriate sufficientfor toall limittested, sessionssupported via a web server or application server alone because legitimate users and adversaries can potentially connect to the DBMS by other meansscenarios.
The organization will need to define out-of-the-box maximumconfiguration numberis of concurrent sessions by account typedynamic, bybased account,on or a combinationlower thereof.limit Inplus decidingallowances onfor the appropriateresources number,assigned it is important to considerVCSA theand work requirements of the variousdeployment types of userssize. For exampleHowever, twothis mightnumber bewill analways acceptable limit for general users accessing the database via an application, but 10 might be toobetween few100 for a database administrator using a database management GUI tool, where each query tab and navigation1000 pane may count as a separate session(inclusive).
Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.
V-239197CAT IIVMware Postgres log files must contain required fields.Discussion
Discussion
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
AuditAs recordsan canembedded bedatabase generatedthat fromis variousonly componentsaccessible withinvia the DBMS (e.g.localhost, process,VMware module).Postgres Certainon specific application functionalities may be audited as well. The list of audited events is the setVCSA ofdoes eventsnot forimplement whichrobust audits are to be generatedauditing. ThisHowever, setit ofcan events is typically a subset of the list of all events for which the system is capable of generating audit records.
DoD has defined the list of events for which the DBMS will provide an audit record generation capability as the following:
(i) Successful and unsuccessfulmust attemptsbe configured to access,log modify,reasonable or delete privileges, security objects, security levels, or categories of information (e.g.,relating classificationto levels);
(ii)user Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to theenable system,proper concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and
(iii) All account creation, modification, disabling, and termination actionstroubleshooting.
Organizations may define additional events requiring continuous or ad hoc auditing.
Satisfies: SRG-APP-000089-DB-000064, SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000375-DB-000323
V-239198CAT IIVMware Postgres configuration files must not be accessible by unauthorized users.Discussion
Discussion
WithoutVMware thePostgres capabilityhas toseveral restrictconfiguration whichfiles rolesthat anddirectly individualscontrol canthe selectsecurity whichposture eventsof arethe audited,DBMS. unauthorizedProtecting personnelthese mayfiles befrom ableunauthorized toaccess preventand ormodification interfereis withfundamental theto auditingensuring ofthe criticalsecurity events.
Suppression of auditingVMware could permit an adversary to evade detectionPostgres.
Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.
Satisfies: SRG-APP-000090-DB-000065, SRG-APP-000121-DB-000202, SRG-APP-000122-DB-000203, SRG-APP-000123-DB-000204, SRG-APP-000380-DB-000360
V-239199CAT IIVMware Postgres must be configured to overwrite older logs when necessary.Discussion
Discussion
ItWithout isproper critical that when the DBMS is at risk of failing to process audit logs as requiredconfiguration, itlog takefiles actionfor toVMware mitigatePostgres thecan failure.grow Auditwithout processing failures include software/hardware errorsbound, failuresfilling in the auditpartition capturing mechanisms, and auditpotentially storageaffecting capacity being reached or exceeded. Responses to audit failure depend on the natureavailability of the failure modeVCSA.
WhenOne availabilitypart is an overriding concern, approved actions in response to an audit failure are as follows:
(i) If the failure was caused by the lack of audit record storage capacity, the DBMS must continue generating audit records, if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner.
(ii) If audit records are sent to a centralized collection server and communication with this serverconfiguration is lostto orensure thethat server fails, the DBMSlogging mustsubsystem queueoverwrites, auditrather recordsthan locallyappending until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, actionany shouldprevious belogs takenthat towould synchronizeshare the localsame audit data with the collection servername.
Systems whereThis availability is paramountavoided willin mostother likelyconfiguration be MAC I; the final determination is the prerogative of the application ownersteps, subjectbut tothis Authorizingbest Officialpractice concurrence.should Inalso any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situationsfollowed.
V-239200CAT IIVMware Postgres database must protect log files from unauthorized access and modification.Discussion
Discussion
If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage.
To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc.
This requirement can be achieved through multiple methods, which will depend on system architecture and design. Some commonly employed methods include ensuring log files have the proper file system permissions, using file system protections, and limiting log data location.
Additionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access.
Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.
Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061
V-239201CAT IIAll VCDB tables must be owned by the "vc" user account.Discussion
Discussion
Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Database functions and procedures can be coded using definer's rights. This allows anyone who uses the object to perform the actions if they were the owner. If not properly managed, this can lead to privileged actions being taken by unauthorized individuals.
Conversely,VCDB ifis criticalconfigured tablesout orof otherthe objectsbox relyto onbe unauthorizedowned ownerby accounts,the these"vc" objectsPostgres mayuser. beThis lostconfiguration whenmust anbe accountverified isand removedmaintained.
V-239202CAT IIVMware Postgres must limit modify privileges to authorized accounts.Discussion
Discussion
If theVMware DBMSPostgres were to allow any user to make changes to database structure or logic, those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.
Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components to initiate changes, including upgrades and modifications.
Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.
V-239204CAT IVMware Postgres must require authentication on all connections.Discussion
Discussion
To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.
OrganizationalVMware usersPostgres includeclient organizationalauthentication employeesis orconfigured individualsin the"pg_hba.conf". organizationIn deemsthis tofile haveare equivalenta statusnumber of employeeslines (e.g.,that contractors).specify Organizationalwho userscan (andconnect anyto processesthe actingservice, onfrom behalfwhere, of users) must be uniquely identified and authenticatedusing forwhat allauthentication accesses,methods. exceptIn thePostgres following:
(i)there Accessesis explicitlya identifiedconcept andof documenteda bytrusted theconnection organization.where Organizationsa document specific usernetwork actionsmask that can beconnect performed on the information system without identificationany or authentication;,
(ii)to Accessesany thataccount. occurThis throughconnection authorizedis usetermed of"trust" groupin authenticators"pg_hba.conf" withoutand individualit authentication.must Organizationsnot maybe requirepresent. uniqueOut identification of individualsthe usingbox, sharedVMware accountsPostgres forrequires detailedstandard accountabilitypassword ofauthentication individualfor activityall connections.
Satisfies: SRG-APP-000148-DB-000103, SRG-APP-000171-DB-000074
V-239205CAT IVMware Postgres must be configured to use TLS.Discussion
Discussion
The DoD standard for authentication is DoD-approved PKI certificates.
Authentication based on user ID and password may be used only when it is not possible to employ a PKI certificate and requires AO approval.
In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission.
DBMSVMware passwordsPostgres sentis inconfigured clear-textout formatof across the networkbox areto vulnerablerequire toTLS discoveryconnections bywith unauthorizedremote usersclients. DisclosureAs ofan passwordsembedded maydatabase easilyand leadavailable toonly unauthorizedon accesslocalhost tofor thestandalone databaseVCSAs, TLS connections are used only in high-availability deployments for connections between a primary and a standby. This configuration must be verified and maintained.
Satisfies: SRG-APP-000172-DB-000075, SRG-APP-000442-DB-000379
V-239206CAT IVMware Postgres must enforce authorized access to all PKI private keys.Discussion
Discussion
The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key.
If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where the DBMS-stored private keys are used to authenticate the DBMS to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully carryperform out undetected man-in-the-middle attacks against the DBMS system and its clients.
Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules.
All access to the private key(s) of the DBMS must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of the DBMS's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.
V-239207CAT IVMware Postgres must use FIPS 140-2 approved TLS ciphers.Discussion
Discussion
Use of weak or notunvalidated validated cryptographic algorithms undermines the purposes of using encryption and digital signatures to protect data. Weak algorithms can be easily broken, and notunvalidated validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well as the administration settings of the DBMS.
Applications,VMware includingPostgres DBMSs,does usingnot cryptographycurrently areimplement required to use approved NIST FIPS 140-2 validated cryptographic modules. thatThis meetis on the requirementsroadmap of applicable federal lawsbut, Executivein Orders,the directivesinterim, policies,Postgres regulations,can standards,be andconfigured guidance.
Thewith securitystrong functionsciphers validatedfrom asthe part of FIPS 140-2 forapproved cryptographicsuite. modulesAdditionally, areas describedan inembedded FIPSdatabase 140-2and Annexavailable A.
NSAonly Type-Xon (wherelocalhost X=1,for 2,standalone 3VCSAs, 4)TLS productsconnections are NSA-certified,used hardwareonly in high-basedavailability encryptiondeployments modulesfor connections between a primary and a standby.
Satisfies: SRG-APP-000179-DB-000114, SRG-APP-000514-DB-000381, SRG-APP-000514-DB-000382, SRG-APP-000514-DB-000383
V-239208CAT IIVMware Postgres must write log entries to disk prior to returning operation success or failure.Discussion
Discussion
Failure to a known state can address safety or security in accordance with the mission/business needs of the organization.
Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system.
Preserving information system state information helps to facilitate system restart and return to the operational mode of the organization with less disruption of mission/business processes.
BecauseAggregating itlog iswrites usuallysaves noton possibleperformance tobut testleaves thisa capabilitywindow infor alog productiondata environment,loss. systemsThe shouldlogging besystem validatedinside eitherVMware inPostgres ais testingcapable environmentof orwriting priorlogs to installationdisk fully and completely before the associated operation is returned to the client. This isensures usuallythat adatabase functionactivity ofis thealways designcaptured, ofeven in the IDPSevent component.of Compliancea cansystem becrash verifiedduring byor acceptance/validationimmediately processesafter ora vendorgiven attestationoperation.
V-239209CAT IIVMware Postgres must not allow schema access to unauthorized accounts.Discussion
Discussion
An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions.
Security functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based.
Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles.
Database management systems typically separate security functionality from non-security functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and non-security functionality are commingled, users who have access to non-security functionality may be able to access security functionality.
VMware Postgres contains a number of system configuration schema whose access must be strictly limited. By default, the pg_catalog and information_schema objects are configured to only be accessible in a read-only manner publicly, and otherwise only accessible by the Postgres user. This configuration must be verified and maintained.
V-239211CAT IIVMware Postgres must provide non-privileged users with minimal error information.Discussion
Discussion
Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of error messages needmust tocontain be carefully considered by the organizationminimal andamount developmentof teaminformation.
Databases can inadvertently provide a wealth of information to an attacker through improperly handled error messages. In addition to sensitive business or personal information, database errors can provide host names, IP addresses, user names, and other system information not required for troubleshooting but very useful to someone targeting the system.
Carefully consider the structure/content of error messages. The extent to which information systems are able to identify and handle error conditions is guided by organizational policy and operational requirements. Information that could be exploited by adversaries includes, for example, logon attempts with passwords entered by mistake as the username, mission/business information that can be derived from (if not stated explicitly by) information recorded, and personal information, such as account numbers, Social Security numbers, and credit card numbers.
This calls for inspection of application source code, which will require collaboration with the application developers. It is recognized that in many cases, the database administrator (DBA) is organizationally separate from the application developers, and may have limited, if any, access to source code. Nevertheless, protections of this type are so important to the secure operation of databases that they must not be ignored. At a minimum, the DBA must attempt to obtain assurances from the development organization that this issue has been addressed and must document what has been discovered.
Satisfies: SRG-APP-000266-DB-000162, SRG-APP-000267-DB-000163
V-239212CAT IIVMware Postgres must have log collection enabled.Discussion
Discussion
Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack.
The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records.
TheVMware DBMSPostgres mayis writecapable auditof recordsoutputting todirectly database tables, to filessyslog inbut thefor fileperformance systemreasons, tothe otherVCSA kindsis ofconfigured localto repository,ship orlogs directlycentrally tovia arsyslog centralizedfile log management systemmonitoring. WhateverTo thefacilitate methodthat usedconfiguration, itlog files must be compatiblegenerated with offloading the records to the centralized systemdisk.
Satisfies: SRG-APP-000356-DB-000314, SRG-APP-000356-DB-000315, SRG-APP-000381-DB-000361, SRG-APP-000492-DB-000333, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357, SRG-APP-000508-DB-000358, SRG-APP-000492-DB-000332, SRG-APP-000503-DB-000351, SRG-APP-000506-DB-000353
V-239213CAT IIVMware Postgres must be configured to log to stderr.Discussion
Discussion
OrganizationsWithout arethe requiredability to usecentrally amanage centralthe logcontent managementcaptured systemin so,the underaudit normalrecords, conditionsidentification, thetroubleshooting, auditand spacecorrelation allocatedof tosuspicious thebehavior DBMSwould onbe itsdifficult ownand servercould willlead notto bea delayed or incomplete analysis of an issueongoing attack.
The However,content spacecaptured willin stillaudit records must be requiredmanaged onfrom thea DBMScentral serverlocation for(necessitating auditautomation). recordsCentralized inmanagement transit,of and,audit underrecords abnormaland conditions,logs thisprovides couldfor fillefficiency up.in Becausemaintenance aand requirementmanagement existsof torecords, haltas processingwell uponas auditthe failure,backup aand servicearchiving outageof wouldthose resultrecords.
IfFor supportVMware personnelPostgres arelogs notto notifiedbe immediatelysuccessfully uponsent storageto volumea utilizationremote reachinglog 75%management system, theylog areevents unablemust be sent to planstderr. forThose storageevents capacitywill expansion.be
Thecaptured appropriateand supportlogged staffto includedisk, atwhere athey minimum,will thebe ISSOpicked andup theby DBA/SArsyslog for shipping.
Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000515-DB-000318
V-239214CAT IIRsyslog must be configured to monitor VMware Postgres logs.Discussion
Discussion
OrganizationsFor areperformance requiredreasons, torsyslog usefile amonitoring centralis logpreferred managementover system,configuring so,VMware underPostgres normalto conditions,send theevents audit space allocated to thea DBMSsyslog onfacility. itsWithout ownensuring serverthat willlogs notare be an issue. Howevercreated, spacethat willrsyslog stillconfigs beare required on the DBMS server for audit records in transitcreated, and, underthat abnormalthose conditions,configs thisare could fill up. Because a requirement exists to halt processing upon audit failureloaded, athe servicelog outagefile wouldmonitoring result.
Ifand supportshipping personnelwill are not notifiedbe immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansioneffective.
The appropriate support staff include, at a minimum, the ISSO and the DBA/SA.
Satisfies: SRG-APP-000359-DB-000319, SRG-APP-000360-DB-000320, SRG-APP-000092-DB-000208
V-239215CAT IIVMware Postgres must use Coordinated Universal Time (UTC) for log timestamps.Discussion
Discussion
If time stamps are not applied consistently applied and there is no common time reference, it is difficult to perform forensic analysis.
Time stamps generated by theVMware DBMSPostgres must include date and time. Time is commonly expressed in UTC, a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.
Some DBMS products offer a data type called TIMESTAMP that is not a representation of date and time. Rather, it is a database state counter and does not correspond to calendar and clock time. This requirement does not refer to that meaning of TIMESTAMP.
V-239216CAT IIVMware Postgres must set client-side character encoding to UTF-8.Discussion
Discussion
A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information system responses to the invalid input may be disruptive or cause the system to fail to an unsafe state.
The behavior will be derived from the organizational and system requirements and includes but is not limited to notifying the appropriate personnel, creating an audit record, and rejecting invalid input.
This calls for inspection of application source code, which will require collaboration with the application developers. It is recognized that in many cases, the DBA is organizationally separate from the application developer, and may have limited, if any, access to source code. Nevertheless, protections of this type are so important to the secure operation of databases that they must not be ignored. At a minimum, the DBA must attempt to obtain assurances from the development organization that this issue has been addressed and must document what has been discovered.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.