The EDB Postgres Advanced Server must generate audit records when successful/unsuccessful logons, connections, or connection attempts occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-224232	EP11-00-011800	SV-224232r508023_rule		Medium

Description
For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to the DBMS. It is also necessary to track failed attempts to log on to the DBMS. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured. Satisfies: SRG-APP-000503-DB-000350,SRG-APP-000503-DB-000351

Description

For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to the DBMS. It is also necessary to track failed attempts to log on to the DBMS. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured. Satisfies: SRG-APP-000503-DB-000350,SRG-APP-000503-DB-000351

STIG	Date
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide	2020-09-23

Details

Check Text ( C-25905r495713_chk )
Execute the following SQL as enterprisedb: SHOW edb_audit_connect; If the result is not "all" or if the current setting for this requirement has not been noted and approved by the organization in the system documentation, this is a finding.

Fix Text (F-25893r495714_fix)
Execute the following SQL as enterprisedb: ALTER SYSTEM SET edb_audit_connect = 'all'; SELECT pg_reload_conf(); or Update the system documentation to note the organizationally approved setting and corresponding justification of the setting for this requirement.