None Computing title VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide version 1 releaseinfo Release: 1 Vuln_Num V-259166 Rule_ID SV-259166r935402_rule Severity medium Rule_Title The vCenter PostgreSQL service must limit the number of concurrent sessions. Vuln_Discuss Database management includes the ability to control the number of users and user sessions utilizing a database management system (DBMS). Unlimited concurrent connections to the DBMS could allow a successful denial-of-service (DoS) attack by exhausting connection resources, and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. VMware Postgres as deployed on the vCenter Service Appliance (VCSA) comes preconfigured with a "max_connections" limit that is appropriate for all tested, supported scenarios. The out-of-the-box configuration is dynamic, based on a lower limit plus allowances for the resources assigned to VCSA and the deployment size. However, this number will always be between 100 and 1000 (inclusive). Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW max_connections;" If the returned number is not greater than or equal to 100 and less than or equal to 1000, this is a finding. Fix_Text At the command prompt, run the following command: # vmon-cli --restart vmware-vpostgres Note: Restarting the service runs the "pg_tuning" script that will configure "max_connections" to the appropriate value based on the allocated memory for vCenter. Not_Reviewed Vuln_Num V-259167 Rule_ID SV-259167r935405_rule Severity medium Rule_Title The vCenter PostgreSQL service must enable "pgaudit" to provide audit record generation capabilities. Vuln_Discuss Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the database management system (DBMS) (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DOD has defined the list of events for which the DBMS will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions. Organizations may define additional events requiring continuous or ad hoc auditing. Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW shared_preload_libraries;" Example result: health_status_worker,pg_stat_statements,pgaudit If the output from the command does not include pgaudit, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259168 Rule_ID SV-259168r935408_rule Severity medium Rule_Title The vCenter PostgreSQL service configuration files must not be accessible by unauthorized users. Vuln_Discuss Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. Suppression of auditing could permit an adversary to evade detection. Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Satisfies: SRG-APP-000090-DB-000065, SRG-APP-000121-DB-000202, SRG-APP-000122-DB-000203, SRG-APP-000123-DB-000204, SRG-APP-000380-DB-000360 Check_Content At the command prompt, run the following command: # find /storage/db/vpostgres/*conf* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \; If any files are returned, this is a finding. Fix_Text At the command prompt, run the following commands: # chmod 600 <file> # chown vpostgres:vpgmongrp <file> Note: Replace <file> with the file that has incorrect permissions. Not_Reviewed Vuln_Num V-259169 Rule_ID SV-259169r935411_rule Severity medium Rule_Title The vCenter PostgreSQL service must generate audit records. Vuln_Discuss Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. Database management systems (DBMS) typically make such information available through views or functions. This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that PostgreSQL continually performs to determine if any and every action on the database is permitted. Satisfies: SRG-APP-000091-DB-000066, SRG-APP-000091-DB-000325, SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357 Check_Content At the command prompt, run the following commands: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_catalog;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_parameter;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_statement_once;" # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW pgaudit.log_level;" If "pgaudit.log_catalog" is not set to "on", this is a finding. If "pgaudit.log" is not set to "all, -misc", this is a finding. If "pgaudit.log_parameter" is not set to "on", this is a finding. If "pgaudit.log_statement_once" is not set to "off", this is a finding. If "pgaudit.log_level" is not set to "log", this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259170 Rule_ID SV-259170r935414_rule Severity medium Rule_Title The vCenter PostgreSQL service must initiate session auditing upon startup. Vuln_Discuss Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time the database management system (DBMS) is running. Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_destination;" Example result: stderr If "log_destination" is not set to "stderr" or "syslog", this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259171 Rule_ID SV-259171r935417_rule Severity medium Rule_Title The vCenter PostgreSQL service must produce logs containing sufficient information to establish what type of events occurred. Vuln_Discuss Information system auditing capability is critical for accurate forensic analysis. Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit record content that may be necessary to satisfy the requirement of this policy includes, for example, time stamps, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured application. Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly what actions were performed. This requires specific information regarding the event type an audit record is referring to. If event type information is not recorded and stored with the audit record, the record itself is of very limited use. Satisfies: SRG-APP-000095-DB-000039, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000101-DB-000044, SRG-APP-000375-DB-000323 Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_line_prefix;" Expected result: %m %c %x %d %u %r %p %l If the output does not include each option in the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259172 Rule_ID SV-259172r935420_rule Severity medium Rule_Title The vCenter PostgreSQL service must be configured to protect log files from unauthorized access. Vuln_Discuss If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061 Check_Content Verify the default log file permissions and permissions on existing log files. At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_file_mode;" Expected result: 0600 If "log_file_mode" is not set to "0600", this is a finding. At the command prompt, run the following command: # find /var/log/vmware/vpostgres/* -xdev -type f -a '(' -not -perm 600 -o -not -user vpostgres -o -not -group vpgmongrp ')' -exec ls -ld {} \; If any files are returned, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres At the command prompt, run the following commands: # chmod 600 <file> # chown vpostgres:vpgmongrp <file> Note: Replace <file> with the file that has incorrect permissions. Not_Reviewed Vuln_Num V-259173 Rule_ID SV-259173r935423_rule Severity medium Rule_Title The vCenter PostgreSQL service must not load unused database components, software, and database objects. Vuln_Discuss Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Database management systems (DBMS) must adhere to the principles of least functionality by providing only essential capabilities. Satisfies: SRG-APP-000141-DB-000091, SRG-APP-000141-DB-000093 Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "select * from pg_extension where extname != 'plpgsql'" If any extensions are output, this is a finding. Fix_Text At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -c "DROP EXTENSION <extension name>" Note: It is recommended that plpgsql not be removed. Not_Reviewed Vuln_Num V-259174 Rule_ID SV-259174r935426_rule Severity medium Rule_Title The vCenter PostgreSQL service must be configured to use an authorized port. Vuln_Discuss In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols/services on information systems. Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. Database Management Systems using ports, protocols, and services deemed unsafe are open to attack through those ports, protocols, and services. This can allow unauthorized access to the database and through the database to other components of the information system. Satisfies: SRG-APP-000142-DB-000094, SRG-APP-000383-DB-000364 Check_Content At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW port;" Expected result: 5432 If the output does not match the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259175 Rule_ID SV-259175r935429_rule Severity medium Rule_Title The vCenter PostgreSQL service must require authentication on all connections. Vuln_Discuss To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: (i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and (ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity. Satisfies: SRG-APP-000148-DB-000103, SRG-APP-000172-DB-000075 Check_Content At the command prompt, run the following command: # grep -v "^#" /storage/db/vpostgres/pg_hba.conf |grep '\S' If any lines are returned contain "trust" or "password" as an auth-method, this is a finding. Fix_Text Navigate to and open: /storage/db/vpostgres/pg_hba.conf Find and update any line that has a method of "trust" or "password" in the far-right column. A correct, typical line will look like the below: # TYPE DATABASE USER ADDRESS METHOD local VCDB vpxd peer map=vcdb Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259176 Rule_ID SV-259176r935432_rule Severity high Rule_Title The vCenter PostgreSQL service must encrypt passwords for user authentication. Vuln_Discuss The DOD standard for authentication is DOD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate and requires AO approval. In such cases, database passwords stored in clear text, using reversible encryption, or using unsalted hashes would be vulnerable to unauthorized disclosure. Database passwords must always be in the form of one-way, salted hashes when stored internally or externally to the database management system (DBMS). Check_Content At the command prompt, run the following command: $ /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW password_encryption;" Expected result: scram-sha-256 If the output does not match the expected result, this is a finding. Note: Prior to Update 2, "md5" is the expected result. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259177 Rule_ID SV-259177r935435_rule Severity high Rule_Title The vCenter PostgreSQL service must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL. Vuln_Discuss The DOD standard for authentication is DOD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where the database management system (DBMS)-stored private keys are used to authenticate the DBMS to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against the DBMS system and its clients. Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules. All access to the private key(s) of the DBMS must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of the DBMS's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions. Check_Content At the command prompt, run the following command: # stat -c "%n is owned by %U:%G with permissions of %a" /storage/db/vpostgres_ssl/server.key Example output: /storage/db/vpostgres_ssl/server.key is owned by vpostgres:vpgmongrp with permissions of 600 If the SSL key file is not owned by the user vpostgres and group vpgmongrp, this is a finding. If the SSL key file has permissions more permissive than 0600, this is a finding. Fix_Text At the command prompt, enter the following commands: # chmod 600 /storage/db/vpostgres_ssl/server.key # chown vpostgres:vpgmongrp /storage/db/vpostgres_ssl/server.key Not_Reviewed Vuln_Num V-259178 Rule_ID SV-259178r935438_rule Severity medium Rule_Title The vCenter PostgreSQL service must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values. Vuln_Discuss One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 approved random number generator. However, it is recognized that available database management system (DBMS) products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective. Satisfies: SRG-APP-000224-DB-000384, SRG-APP-000441-DB-000378, SRG-APP-000442-DB-000379 Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW ssl;" If "ssl" is not set to "on", this is a finding. Fix_Text At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl = 'on';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_cert_file = '/storage/db/vpostgres_ssl/server.crt';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_key_file = '/storage/db/vpostgres_ssl/server.key';" # /opt/vmware/vpostgres/current/bin/psql -U postgres -c "ALTER SYSTEM SET ssl_ca_file = '/storage/db/vpostgres_ssl/root_ca.pem';" Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259179 Rule_ID SV-259179r935441_rule Severity medium Rule_Title The vCenter PostgreSQL service must write log entries to disk prior to returning operation success or failure. Vuln_Discuss Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. Preserving system state information helps to facilitate system restart and return to the operational mode of the organization with less disruption of mission/business processes. Aggregating log writes saves on performance but leaves a window for log data loss. The logging system inside PostgreSQL is capable of writing logs to disk, fully and completely before the associated operation is returned to the client. This ensures that database activity is always captured, even in the event of a system crash during or immediately after a given operation. Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SELECT name,setting FROM pg_settings WHERE name IN ('fsync','full_page_writes','synchronous_commit');" Expected result: fsync | on full_page_writes | on synchronous_commit | on If the output does not match the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259180 Rule_ID SV-259180r935444_rule Severity medium Rule_Title The vCenter PostgreSQL service must provide nonprivileged users with minimal error information. Vuln_Discuss Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of error messages need to contain the minimal amount of information. Databases can inadvertently provide a wealth of information to an attacker through improperly handled error messages. In addition to sensitive business or personal information, database errors can provide host names, IP addresses, usernames, and other system information not required for troubleshooting but very useful to someone targeting the system. Satisfies: SRG-APP-000266-DB-000162, SRG-APP-000267-DB-000163 Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW client_min_messages;" Expected result: error If the output does not match the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259181 Rule_ID SV-259181r935447_rule Severity medium Rule_Title The vCenter PostgreSQL service must have log collection enabled. Vuln_Discuss Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Satisfies: SRG-APP-000356-DB-000314, SRG-APP-000381-DB-000361 Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW logging_collector;" Expected result: on If the output does not match the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259182 Rule_ID SV-259182r935450_rule Severity medium Rule_Title The vCenter PostgreSQL service must use Coordinated Universal Time (UTC) for log timestamps. Vuln_Discuss If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. Time stamps generated by PostgreSQL must include date and time. Time is commonly expressed in UTC, a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_timezone;" Expected result: UTC If the output does not match the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259183 Rule_ID SV-259183r935453_rule Severity medium Rule_Title The vCenter PostgreSQL service must log all connection attempts. Vuln_Discuss For completeness of forensic analysis, it is necessary to track successful and failed attempts to log on to PostgreSQL. Setting "log_connections" to "on" will cause each attempted connection to the server to be logged, as well as successful completion of client authentication. Satisfies: SRG-APP-000503-DB-000350, SRG-APP-000503-DB-000351, SRG-APP-000506-DB-000353, SRG-APP-000508-DB-000358 Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_connections;" Expected result: on If the output does not match the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259184 Rule_ID SV-259184r935456_rule Severity medium Rule_Title The vCenter PostgreSQL service must log all client disconnections. Vuln_Discuss Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged. For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to PostgreSQL lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. Check_Content At the command prompt, run the following command: # /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_disconnections;" Expected result: on If the output does not match the expected result, this is a finding. Fix_Text A script is included with vCenter to generate a PostgreSQL STIG configuration. At the command prompt, run the following commands: # chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py # /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres # chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py Restart the PostgreSQL service by running the following command: # vmon-cli --restart vmware-vpostgres Not_Reviewed Vuln_Num V-259185 Rule_ID SV-259185r935459_rule Severity medium Rule_Title The vCenter PostgreSQL service must off-load audit data to a separate log management facility. Vuln_Discuss Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. The database management system (DBMS) may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system. Check_Content By default there is a vmware-services-vmware-vpostgres.conf rsyslog and vmware-services-vmware-postgres-archiver.conf configuration file that includes the service logs when syslog is configured on vCenter but it must be verified. At the command prompt, run the following command: # cat /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Expected result: # vmware-vpostgres first logs stdout, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stdout" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres first logs stderr, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stderr" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") If the output does not match the expected result, this is a finding. At the command prompt, run the following command: # cat /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Expected result: # vmware-postgres-archiver stdout log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stdout" Tag="postgres-archiver" Severity="info" Facility="local0") # vmware-postgres-archiver stderr log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stderr" Tag="postgres-archiver" Severity="info" Facility="local0") If the output does not match the expected result, this is a finding. Fix_Text Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-vpostgres.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-vpostgres first logs stdout, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stdout" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres first logs stderr, before loading configuration input(type="imfile" File="/var/log/vmware/vpostgres/serverlog.stderr" Tag="vpostgres-first" Severity="info" Facility="local0") # vmware-vpostgres logs input(type="imfile" File="/var/log/vmware/vpostgres/postgresql-*.log" Tag="vpostgres" Severity="info" Facility="local0") Navigate to and open: /etc/vmware-syslog/vmware-services-vmware-postgres-archiver.conf Create the file if it does not exist. Set the contents of the file as follows: # vmware-postgres-archiver stdout log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stdout" Tag="postgres-archiver" Severity="info" Facility="local0") # vmware-postgres-archiver stderr log input(type="imfile" File="/var/log/vmware/vpostgres/pg_archiver.log.stderr" Tag="postgres-archiver" Severity="info" Facility="local0") Not_Reviewed