← Back to VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide

V-256596

CAT II (Medium)

All vCenter database (VCDB) tables must be owned by the "vc" user account.

Rule ID

SV-256596r918971_rule

STIG

VMware vSphere 7.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-001499

Discussion

Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Database functions and procedures can be coded using definer's rights. This allows anyone who uses the object to perform the actions if they are the owner. If not properly managed, this can lead to privileged actions being taken by unauthorized individuals. VCDB is configured out of the box to be owned by the "vc" Postgres user. This configuration must be verified and maintained.

Check Content

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -d VCDB -U postgres -t -A -c "\dt;" | grep -v 'table|vc'

If any tables are returned, this is a finding.

Note: Upgrades may introduce new tables that are owned by the "postgres" user and can be updated to be owned by the "vc" user.

Fix Text

At the command prompt, run the following command:

# /opt/vmware/vpostgres/current/bin/psql -d VCDB -U postgres -c "ALTER TABLE <tablename> OWNER TO vc;"

Replace <tablename> with the name of the table discovered during the check.