DISA_STIG_PostgreSQL_9-x_on_RHEL_v2r3_OS.audit from DISA PostgreSQL 9.x v2r3 STIG

PGS9-00-000400 - The audit information produced by PostgreSQL must be protected from unauthorized modification - log directory

CAT|II

CCI|CCI-000163

Rule-ID|SV-214051r508027_rule

STIG-ID|PGS9-00-000400

STIG-Legacy|SV-87499

STIG-Legacy|V-72847

Vuln-ID|V-214051

PGS9-00-000400 - The audit information produced by PostgreSQL must be protected from unauthorized modification - log files

PGS9-00-000400 - The audit information produced by PostgreSQL must be protected from unauthorized modification - log_file_mode

PGS9-00-000500 - PostgreSQL must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-214052r836915_rule

STIG-ID|PGS9-00-000500

STIG-Legacy|SV-87501

STIG-Legacy|V-72849

Vuln-ID|V-214052

PGS9-00-000700 - Privileges to change PostgreSQL software modules must be limited - binary objects

CCI|CCI-001499

Rule-ID|SV-214054r508027_rule

STIG-ID|PGS9-00-000700

STIG-Legacy|SV-87505

STIG-Legacy|V-72853

Vuln-ID|V-214054

PGS9-00-000700 - Privileges to change PostgreSQL software modules must be limited - data

PGS9-00-000700 - Privileges to change PostgreSQL software modules must be limited - shared objects

PGS9-00-000710 - PostgreSQL must limit privileges to change functions and triggers, and links to software external to PostgreSQL - config

Rule-ID|SV-214055r508027_rule

STIG-ID|PGS9-00-000710

STIG-Legacy|SV-87507

STIG-Legacy|V-72855

Vuln-ID|V-214055

PGS9-00-000710 - PostgreSQL must limit privileges to change functions and triggers, and links to software external to PostgreSQL - database

PGS9-00-000800 - If passwords are used for authentication, PostgreSQL must transmit only encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-214056r836916_rule

STIG-ID|PGS9-00-000800

STIG-Legacy|SV-87509

STIG-Legacy|V-72857

Vuln-ID|V-214056

PGS9-00-000900 - PostgreSQL must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies - authentication

CCI|CCI-000213

Rule-ID|SV-214057r836917_rule

STIG-ID|PGS9-00-000900

STIG-Legacy|SV-87511

STIG-Legacy|V-72859

Vuln-ID|V-214057

PGS9-00-000900 - PostgreSQL must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies - role privileges

PGS9-00-000900 - PostgreSQL must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies - table privileges

PGS9-00-001100 - PostgreSQL must associate organization-defined types of security labels having organization-defined security label values with information in transmission.

CCI|CCI-002264

Rule-ID|SV-214058r508027_rule

STIG-ID|PGS9-00-001100

STIG-Legacy|SV-87513

STIG-Legacy|V-72861

Vuln-ID|V-214058

PGS9-00-001300 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (functions, trigger procedures, links to software external to PostgreSQL, etc.) must be restricted to authorized users - s used to modify database structure and logic modules must be restricted to authorized users.

Rule-ID|SV-214060r508027_rule

STIG-ID|PGS9-00-001300

STIG-Legacy|SV-87517

STIG-Legacy|V-72865

Vuln-ID|V-214060

PGS9-00-001400 - PostgreSQL must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

CCI|CCI-000804

Rule-ID|SV-214061r508027_rule

STIG-ID|PGS9-00-001400

STIG-Legacy|SV-87519

STIG-Legacy|V-72867

Vuln-ID|V-214061

PGS9-00-001700 - PostgreSQL must associate organization-defined types of security labels having organization-defined security label values with information in storage.

CCI|CCI-002262

Rule-ID|SV-214062r508027_rule

STIG-ID|PGS9-00-001700

STIG-Legacy|SV-87521

STIG-Legacy|V-72869

Vuln-ID|V-214062

PGS9-00-002100 - PostgreSQL must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-214066r508027_rule

STIG-ID|PGS9-00-002100

STIG-Legacy|SV-87529

STIG-Legacy|V-72877

Vuln-ID|V-214066

PGS9-00-002200 - PostgreSQL must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - df+

CCI|CCI-002165

Rule-ID|SV-214067r508027_rule

STIG-ID|PGS9-00-002200

STIG-Legacy|SV-87535

STIG-Legacy|V-72883

Vuln-ID|V-214067

PGS9-00-002200 - PostgreSQL must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - dn

PGS9-00-002200 - PostgreSQL must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - ds

PGS9-00-002200 - PostgreSQL must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - dt

PGS9-00-002200 - PostgreSQL must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - dv

PGS9-00-002300 - The audit information produced by PostgreSQL must be protected from unauthorized deletion - log directory

CCI|CCI-000164

Rule-ID|SV-214068r508027_rule

STIG-ID|PGS9-00-002300

STIG-Legacy|SV-87537

STIG-Legacy|V-72885

Vuln-ID|V-214068

PGS9-00-002300 - The audit information produced by PostgreSQL must be protected from unauthorized deletion - log files

PGS9-00-002300 - The audit information produced by PostgreSQL must be protected from unauthorized deletion - log_file_mode

PGS9-00-002500 - PostgreSQL must reveal detailed error messages only to the ISSO, ISSM, SA and DBA.

CCI|CCI-001314

Rule-ID|SV-214070r548749_rule

STIG-ID|PGS9-00-002500

STIG-Legacy|SV-87541

STIG-Legacy|V-72889

Vuln-ID|V-214070

PGS9-00-002600 - PostgreSQL must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - Config

CCI|CCI-000171

Rule-ID|SV-214071r508027_rule

STIG-ID|PGS9-00-002600

STIG-Legacy|SV-87543

STIG-Legacy|V-72891

Vuln-ID|V-214071

PGS9-00-002600 - PostgreSQL must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - Data

PGS9-00-002600 - PostgreSQL must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - Roles

PGS9-00-003000 - PostgreSQL must maintain the confidentiality and integrity of information during reception.

CCI|CCI-002422

Rule-ID|SV-214073r548754_rule

STIG-ID|PGS9-00-003000

STIG-Legacy|SV-87547

STIG-Legacy|V-72895

Vuln-ID|V-214073

PGS9-00-003100 - Database objects (including but not limited to tables, indexes, storage, trigger procedures, functions, links to software external to PostgreSQL, etc.) must be owned by database/DBMS principals authorized for ownership - df+

Rule-ID|SV-214074r508027_rule

STIG-ID|PGS9-00-003100

STIG-Legacy|SV-87549

STIG-Legacy|V-72897

Vuln-ID|V-214074

PGS9-00-003100 - Database objects (including but not limited to tables, indexes, storage, trigger procedures, functions, links to software external to PostgreSQL, etc.) must be owned by database/DBMS principals authorized for ownership - dn

PGS9-00-003100 - Database objects (including but not limited to tables, indexes, storage, trigger procedures, functions, links to software external to PostgreSQL, etc.) must be owned by database/DBMS principals authorized for ownership - ds

PGS9-00-003100 - Database objects (including but not limited to tables, indexes, storage, trigger procedures, functions, links to software external to PostgreSQL, etc.) must be owned by database/DBMS principals authorized for ownership - dt

PGS9-00-003100 - Database objects (including but not limited to tables, indexes, storage, trigger procedures, functions, links to software external to PostgreSQL, etc.) must be owned by database/DBMS principals authorized for ownership - dv

PGS9-00-003300 - Database software, including PostgreSQL configuration files, must be stored in dedicated directories separate from the host OS and other applications.

Rule-ID|SV-214076r508027_rule

STIG-ID|PGS9-00-003300

STIG-Legacy|SV-87553

STIG-Legacy|V-72901

Vuln-ID|V-214076

PGS9-00-004000 - PostgreSQL must isolate security functions from non-security functions - df+ custom tables

CCI|CCI-001084

Rule-ID|SV-214081r508027_rule

STIG-ID|PGS9-00-004000

STIG-Legacy|SV-87563

STIG-Legacy|V-72911

Vuln-ID|V-214081

PGS9-00-004000 - PostgreSQL must isolate security functions from non-security functions - df+ information_schema

PGS9-00-004000 - PostgreSQL must isolate security functions from non-security functions - df+ pg_catalog

PGS9-00-004000 - PostgreSQL must isolate security functions from non-security functions - dp custom tables

PGS9-00-004000 - PostgreSQL must isolate security functions from non-security functions - dp information_schema

PGS9-00-004000 - PostgreSQL must isolate security functions from non-security functions - dp pg_catalog

PGS9-00-004200 - The audit information produced by PostgreSQL must be protected from unauthorized read access - log directory

CCI|CCI-000162

Rule-ID|SV-214083r508027_rule

STIG-ID|PGS9-00-004200

STIG-Legacy|SV-87567

STIG-Legacy|V-72915

Vuln-ID|V-214083

PGS9-00-004200 - The audit information produced by PostgreSQL must be protected from unauthorized read access - log files

PGS9-00-004200 - The audit information produced by PostgreSQL must be protected from unauthorized read access - log_file_mode

PGS9-00-004300 - When updates are applied to PostgreSQL software, any software components that have been replaced or made unnecessary must be removed.

CCI|CCI-002617

Rule-ID|SV-214084r508027_rule

STIG-ID|PGS9-00-004300

STIG-Legacy|SV-87569

STIG-Legacy|V-72917

Vuln-ID|V-214084

PGS9-00-007000 - PostgreSQL, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation - hostssl cert

CCI|CCI-000185

Rule-ID|SV-214111r508027_rule

STIG-ID|PGS9-00-007000

STIG-Legacy|SV-87631

STIG-Legacy|V-72979

Vuln-ID|V-214111

PGS9-00-007000 - PostgreSQL, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation - ssl_crl_file

PGS9-00-007200 - PostgreSQL must maintain the confidentiality and integrity of information during preparation for transmission.

CCI|CCI-002420

Rule-ID|SV-214113r548752_rule

STIG-ID|PGS9-00-007200

STIG-Legacy|SV-87633

STIG-Legacy|V-72981

Vuln-ID|V-214113

PGS9-00-008000 - PostgreSQL must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to generate and validate cryptographic hashes.

CCI|CCI-002450

Rule-ID|SV-214117r836920_rule

STIG-ID|PGS9-00-008000

STIG-Legacy|SV-87641

STIG-Legacy|V-72989

Vuln-ID|V-214117

PGS9-00-008200 - PostgreSQL must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.

Rule-ID|SV-214119r836922_rule

STIG-ID|PGS9-00-008200

STIG-Legacy|SV-87645

STIG-Legacy|V-72993

Vuln-ID|V-214119

PGS9-00-008400 - PostgreSQL must prohibit user installation of logic modules (functions, trigger procedures, views, etc.) without explicit privileged status - dn+

Detections

Analytics

DISA STIG PostgreSQL 9.x on RHEL OS v2r3

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 May 15, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Apr 12, 2023 Miscellaneous Metadata updated.
Revision 1.1 Mar 7, 2023 Miscellaneous Metadata updated. References updated.