The vCenter PostgreSQL service must be configured to protect log files from unauthorized access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259172	VCPG-80-000020	SV-259172r960930_rule		Medium

Description
If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061

Description

If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061

STIG	Date
VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide	2024-07-11

Details

Check Text ( C-62912r935418_chk )
Verify the default log file permissions and permissions on existing log files. At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_file_mode;" Expected result: 0600 If "log_file_mode" is not set to "0600", this is a finding. At the command prompt, run the following command: # find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Check Text ( C-62912r935418_chk )

Verify the default log file permissions and permissions on existing log files.

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_file_mode;"

Expected result:

0600

If "log_file_mode" is not set to "0600", this is a finding.

At the command prompt, run the following command:

# find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \;

If any files are returned, this is a finding.

Fix Text (F-62821r935419_fix)
A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres At the command prompt, run the following commands: # chmod 600 # chown vpostgres:vpgmongrp Note: Replace with the file that has incorrect permissions.

Fix Text (F-62821r935419_fix)

A script is included with vCenter to generate a PostgreSQL STIG configuration.

At the command prompt, run the following commands:

# chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py
# /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres
# chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py

Restart the PostgreSQL service by running the following command:

# vmon-cli --restart vmware-vpostgres

At the command prompt, run the following commands:

# chmod 600
# chown vpostgres:vpgmongrp

Note: Replace with the file that has incorrect permissions.