From VMW vRealize Automation 7.x PostgreSQL Security Technical Implementation Guide
Part of SRG-APP-000499-DB-000331
Associated with: CCI-000172
Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict individuals' and groups' privileges could go undetected.
In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.
To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.
At the command prompt, execute the following command: # grep '^\s*log_statement\b' /storage/db/pgdata/postgresql.conf If "log_statement is not all", this is a finding.
At the command prompt, execute the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET log_statement TO 'all';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "SELECT pg_reload_conf();"
Lavender hyperlinks in small type off to the right (of CSS
id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header
Powered by sagemincer