PostgreSQL must generate audit records when security objects are deleted.

An XCCDF Rule

Description

The removal of security objects from the database/PostgreSQL would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.

ID: SV-261952r1000861_rule
Version: CD16-00-010800
Severity: Medium
References: CCI-000172
Updated: 3 days ago

Remediation Templates

Note: The following instructions use the PGDATA and PGVER environment variables. Refer to APPENDIX-F for instructions on configuring PGDATA and APPENDIX-H for PGVER.

PostgreSQL can be configured to audit these requests using pgaudit. Refer to supplementary content APPENDIX-B for documentation on installing pgaudit.

With pgaudit installed the following configurations can be made:
$ sudo su - postgres
$ vi ${PGDATA?}/postgresql.conf

Add the following parameters (or edit existing parameters):

pgaudit.log = 'ddl'

As the system administrator, reload the server with the new configuration:

$ sudo systemctl reload postgresql-${PGVER?}

PostgreSQL must generate audit records when security objects are deleted.

Description

Remediation Templates

A Manual Procedure