The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

An XCCDF Rule

Description

<VulnDiscussion>Without the capability to restrict the types of roles and individuals that can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. Suppression of auditing could permit an adversary to evade detection. Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-224135r879560_rule
Severity: Medium
References: CCI-000171
Updated: 8 months ago

If a non-EDB provided database auditing solution or a custom auditing solution is being used, configure the DBMS's settings according to the documentation provided for those solutions to allow designated personnel to select which auditable events are audited.

If EDB Auditing is being used, perform the following actions as necessary to address any findings:
1) Postgresql Data Directory Ownership and Permissions:
If the postgresql data directory and its contents are owned by unauthorized users, change ownership to an authorized user.
Restrict access on the postgresql data directory to the database service account, software owner accounts, Administrators, DBAs, System group, or other documented users authorized to start a postgresql database cluster.

2) Postgresql Configuration File Ownership and Permissions:
If the postgresql configuration file(s) is owned by an unauthorized user, change ownership to an authorized user.

Restrict write access on Postgres configuration file(s) the database service account, software owner accounts, Administrators, DBAs, System group, or other documented users authorized to edit the file(s).

3) Database Users Assigned Superuser Privileges:
Remove superuser rights from unauthorized database users via the ALTER ROLE or ALTER USER SQL command.

The syntax is:
ALTER ROLE <role> NOSUPERUSER

or

ALTER USER <user> NOSUPERUSER

Example: 
ALTER ROLE testuser NOSUPERUSER;

OR 

ALTER USER testuser NOSUPERUSER;

See PostgreSQL and/or EDB Postgres Advanced Server documentation for details.

The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

Description

Remediation - Manual Procedure