← Back to EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide

V-224232

CAT II (Medium)

The EDB Postgres Advanced Server must generate audit records when successful/unsuccessful logons, connections, or connection attempts occur.

Rule ID

SV-224232r961824_rule

STIG

EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide

Version

V2R4

CCIs

CCI-000172

Discussion

For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to the DBMS. It is also necessary to track failed attempts to log on to the DBMS. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured. Satisfies: SRG-APP-000503-DB-000350,SRG-APP-000503-DB-000351

Check Content

Execute the following SQL as enterprisedb:

 SHOW edb_audit_connect;

If the result is not "all" or if the current setting for this requirement has not been noted and approved by the organization in the system documentation, this is a finding.

Fix Text

Execute the following SQL as enterprisedb:

 ALTER SYSTEM SET edb_audit_connect = 'all';
 SELECT pg_reload_conf();

or

Update the system documentation to note the organizationally approved setting and corresponding justification of the setting for this requirement.