7.2 Ensure logging of replication commands is configured

Information

Enabling the log_replication_commands setting causes each attempted replication from the server to be logged.

Rationale:

A successful replication connection allows for a complete copy of the data stored within the data cluster to be offloaded to another, potentially insecure, host. As such, it is advisable to log all replication commands that are executed in your database cluster to ensure the data is not off-loaded to an unexpected/undesired location.

Solution

To enable the logging of replication commands, execute the following:

postgres=# ALTER SYSTEM SET log_replication_commands = 'on';
ALTER SYSTEM
postgres=# SELECT pg_reload_conf();
pg_reload_conf
----------------
t
(1 row)
postgres=# show log_replication_commands ;
log_replication_commands
--------------------------
on
(1 row)

See Also

https://workbench.cisecurity.org/benchmarks/11861

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: PostgreSQLDB

Control ID: f16074ec18cb072ee68df38ef6c3bc83acf103deb42480e9df726842a139183b