The EDB Postgres Advanced Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.A database cluster listens on a single port (usually 5444 for Postgres Plus Advanced Server). The Postgres Enterprise Manager (PEM) agents do not listen on ports, they only act as clients to the PEM server. The PEM server has two components (a repository which is a Postgres database) and a PHP application. The PHP application listens on a port configured in Apache, generally 8080 or 8443.The ports to check are: 1) The primary Postgres cluster port, 2) The PEM PHP port, and 3) The PEM Repository DB port. Generally 2 and 3 should be installed on an isolated management machine without access from anyone other than administrators.

Check content

Review the network functions, ports, protocols, and services supported by the DBMS. If any protocol is prohibited by the PPSM guidance and is enabled, this is a finding. Open "/pg_hba.conf" in a viewer. (The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.) If any rows have a TYPE that is "host" or "hostnossl", this is a finding. Execute the following SQL as enterprisedb: SHOW port; If the displayed port is not allowed, this is a finding.

Fix text

Disable each prohibited network function, port, protocol, or service prohibited by the PPSM guidance. Open "/pg_hba.conf" in an editor. (The default path for the postgresql data directory is /var/lib/ppas/9.5/data, but this will vary according to local circumstances.) Change the TYPE of any rows not starting with a "#" to be either "local" or "hostssl". The METHOD for the local rows should be "peer", which will authenticate based on the operating system name. The METHOD for the hostssl rows should be one of these (in preferred order): cert, ldap, sspi, pam, md5 Execute the following SQL as enterprisedb: ALTER SYSTEM SET port = ; Execute the following operating system command as root: systemctl restart ppas-9.5.service

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

SV-83613r1_rule The EDB Postgres Advanced Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

Vulnerability discussion

Check content

Fix text

Pro Tips