From PostgreSQL 9.x Security Technical Implementation Guide
Part of SRG-APP-000496-DB-000335
Associated with: CCI-000172
Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.
Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA.
As the database administrator (shown here as "postgres"), create a test role by running the following SQL:
$ sudo su - postgres
$ psql -c "CREATE ROLE bob"
Next, to test if audit records are generated from unsuccessful attempts at modifying security objects, run the following SQL:
$ sudo su - postgres
$ psql -c "SET ROLE bob; UPDATE pg_authid SET rolsuper = 't' WHERE rolname = 'bob';"
Next, as the database administrator (shown here as "postgres"), verify that the denials were logged:
$ sudo su - postgres
$ cat ${PGDATA?}/pg_log/
Configure PostgreSQL to produce audit records when unsuccessful attempts to modify security objects occur. Unsuccessful attempts to modifying security objects can be logged if logging is enabled. To ensure that logging is enabled, review supplementary content APPENDIX-C for instructions on enabling logging.
Lavender hyperlinks in small type off to the right (of CSS
class id
, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle
or
Accept: application/rdf+xml
.
Powered by sagemincer