V-73059

Severity: Medium

Generated

2019-05-20 15:48:11.984914

Status

Passed

Access to database files must be limited to relevant processes and to authorized, administrative users.

NIST 800-53

STIG # Description Result
SC-4 SC-4: Information In Shared Resources passed

Guidance

Applications, including PostgreSQLs, must prevent unauthorized and unintended information transfer via shared system resources. Permitting only DBMS processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.

Check

Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA.

Review the permissions granted to users by the operating system/file system on the database files, database log files and database backup files.

To verify that all files are owned by the database administrator and have the correct permissions, run the following as the database administrator (shown here as “postgres”):

$ sudo su - postgres $ ls -lR ${PGDATA?}

If any files are not owned by the database administrator or allow anyone but the database administrator to read/write/execute, this is a finding.

If any user/role who is not an authorized system administrator with a need-to-know or database administrator with a need-to-know, or a system account for running PostgreSQL processes, is permitted to read/view any of these files, this is a finding.

Fix

Note: The following instructions use the PGDATA environment variable. See supplementary content APPENDIX-F for instructions on configuring PGDATA.

Configure the permissions granted by the operating system/file system on the database files, database log files, and database backup files so that only relevant system accounts and authorized system administrators and database administrators with a need to know are permitted to read/view these files.

Any files (for example: extra configuration files) created in PGDATA must be owned by the database administrator, with only owner permissions to read, write, and execute.

Test Results

  Result
Command: `find /var/vcap/store/postgresql/data -type f \( ! -perm 600 -or ! -user vcap -or ! -group vcap \)` stdout should eq "" passed
Command: `find /var/vcap/store/postgresql/data -type f \( ! -perm 600 -or ! -user vcap -or ! -group vcap \)` exit_status should cmp == 0 passed
Command: `find /var/vcap/store/postgresql/data -type d \( ! -perm 700 -or ! -user vcap -or ! -group vcap \)` stdout should eq "" passed
Command: `find /var/vcap/store/postgresql/data -type d \( ! -perm 700 -or ! -user vcap -or ! -group vcap \)` exit_status should cmp == 0 passed

Code

control "V-73059" do
  title "Access to database files must be limited to relevant processes and to
authorized, administrative users."
  desc  "Applications, including PostgreSQLs, must prevent unauthorized and
unintended information transfer via shared system resources. Permitting only DBMS
processes and authorized, administrative users to have access to the files where the
database resides helps ensure that those files are not shared inappropriately and
are not open to backdoor access and manipulation."
  impact 0.5
  tag "severity": "medium"
  tag "gtitle": "SRG-APP-000243-DB-000374"
  tag "gid": "V-73059"
  tag "rid": "SV-87711r1_rule"
  tag "stig_id": "PGS9-00-012000"
  tag "cci": "CCI-001090"
  tag "nist": ["SC-4", "Rev_4"]
  tag "check": "Note: The following instructions use the PGDATA environment
variable. See supplementary content APPENDIX-F for instructions on configuring
PGDATA.

Review the permissions granted to users by the operating system/file system on the
database files, database log files and database backup files.

To verify that all files are owned by the database administrator and have the
correct permissions, run the following as the database administrator (shown here as
\"postgres\"):

$ sudo su - postgres
$ ls -lR ${PGDATA?}

If any files are not owned by the database administrator or allow anyone but the
database administrator to read/write/execute, this is a finding.

If any user/role who is not an authorized system administrator with a need-to-know
or database administrator with a need-to-know, or a system account for running
PostgreSQL processes, is permitted to read/view any of these files, this is a
finding."

  tag "fix": "Note: The following instructions use the PGDATA environment variable.
See supplementary content APPENDIX-F for instructions on configuring PGDATA.

Configure the permissions granted by the operating system/file system on the
database files, database log files, and database backup files so that only relevant
system accounts and authorized system administrators and database administrators
with a need to know are permitted to read/view these files.

Any files (for example: extra configuration files) created in PGDATA must be owned
by the database administrator, with only owner permissions to read, write, and
execute."

  find_insecure_files = "find #{PG_DATA} -type f \\( "\
    "! -perm 600 -or ! -user #{PG_OWNER} -or ! -group #{PG_GROUP} \\)"

  describe command(find_insecure_files) do
    its('stdout') { should eq '' }
    its('exit_status') { should cmp 0 }
  end

  find_insecure_dirs = "find #{PG_DATA} -type d \\( "\
    "! -perm 700 -or ! -user #{PG_OWNER} -or ! -group #{PG_GROUP} \\)"

  describe command(find_insecure_dirs) do
    its('stdout') { should eq '' }
    its('exit_status') { should cmp 0 }
  end
end