UCF STIG Viewer Logo

The DBMS must generate audit records when unsuccessful attempts to modify privileges/permissions occur.


Finding ID Version Rule ID IA Controls Severity
V-89411 VRAU-PG-000370 SV-100061r1_rule Medium
Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict individuals' and groups' privileges could go undetected. In PostgreSQL environment, modifying permissions is typically done via the GRANT and REVOKE commands. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.
VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide 2018-10-12


Check Text ( C-89103r1_chk )
At the command prompt, execute the following command:

# grep '^\s*log_statement\b' /storage/db/pgdata/postgresql.conf

If "log_statement" is not "all", this is a finding.
Fix Text (F-96153r1_fix)
At the command prompt, execute the following commands:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_statement TO 'all';"
# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"