← Back to VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide

V-240331

CAT II (Medium)

The vRA PostgreSQL database must set the log_statement to all.

Rule ID

SV-240331r879878_rule

STIG

VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000172

Discussion

Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. In an SQL environment, types of access include, but are not necessarily limited to: SELECT INSERT UPDATE DELETE EXECUTE

Check Content

At the command prompt, execute the following command:

# grep '^\s*log_statement\b' /storage/db/pgdata/postgresql.conf

If "log_statement" is not "all", this is a finding.

Fix Text

At the command prompt, execute the following commands:

# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_statement TO 'all';"
# /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"