PostgreSQL must invalidate session identifiers upon user logout or other session termination.

From PostgreSQL 9.x Security Technical Implementation Guide

Part of SRG-APP-000220-DB-000149

Associated with: CCI-001185

SV-87689r2_rule PostgreSQL must invalidate session identifiers upon user logout or other session termination.

Vulnerability discussion

Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries to capture and continue to employ previously valid session IDs.This requirement focuses on communications protection for PostgreSQL session rather than for the network packet. The intent of this control is to establish grounds for confidence at each end of a communications session in the ongoing identity of the other party and in the validity of the information being transmitted. Session IDs are tokens generated by PostgreSQLs to uniquely identify a user's (or process's) session. DBMSs will make access decisions and execute logic based on the session ID.Unique session IDs help to reduce predictability of said identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. When a user logs out, or when any other session termination event occurs, PostgreSQL must terminate the user session(s) to minimize the potential for sessions to be hijacked.

Check content

As the database administrator (shown here as "postgres"), run the following SQL: $ sudo su - postgres $ psql -c "SHOW tcp_keepalives_idle" $ psql -c "SHOW tcp_keepalives_interval" $ psql -c "SHOW tcp_keepalives_count" $ psql -c "SHOW statement_timeout" If these settings are not set, this is a finding.

Fix text

Note: The following instructions use the PGDATA and PGVER environment variables. See supplementary content APPENDIX-F for instructions on configuring PGDATA and APPENDIX-H for PGVER. As the database administrator (shown here as "postgres"), edit postgresql.conf:  $ sudo su - postgres  $ vi $PGDATA/postgresql.conf  Set the following parameters to organizational requirements:  statement_timeout = 10000 #milliseconds  tcp_keepalives_idle = 10 # seconds  tcp_keepalives_interval = 10 # seconds  tcp_keepalives_count = 10  Now, as the system administrator, restart the server with the new configuration:  # SYSTEMD SERVER ONLY  $ sudo systemctl restart postgresql-${PGVER?} # INITD SERVER ONLY  $ sudo service postgresql-${PGVER?} restart

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer