The EDB Postgres Advanced Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259286	EPAS-00-008700	SV-259286r938911_rule		Medium

Description
Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats. A database cluster listens on a single port (usually 5444 for EDB Postgres Advanced Server). The Postgres Enterprise Manager (PEM) agents do not listen on ports; they only act as clients to the PEM server. The PEM server has two components, a repository (which is a Postgres database) and a web application. The web application listens on a port configured in Apache HTTP Server, generally 8080 or 8443. The ports to check are: the primary Postgres cluster port, the PEM HTTPD port, and the PEM Repository DB port. Generally, the PEM HTTPD port and the PEM Repository DB port should be installed on an isolated management machine with administrator access only.

Description

Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats. A database cluster listens on a single port (usually 5444 for EDB Postgres Advanced Server). The Postgres Enterprise Manager (PEM) agents do not listen on ports; they only act as clients to the PEM server. The PEM server has two components, a repository (which is a Postgres database) and a web application. The web application listens on a port configured in Apache HTTP Server, generally 8080 or 8443. The ports to check are: the primary Postgres cluster port, the PEM HTTPD port, and the PEM Repository DB port. Generally, the PEM HTTPD port and the PEM Repository DB port should be installed on an isolated management machine with administrator access only.

STIG	Date
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide	2023-11-20

Details

Check Text ( C-63025r938909_chk )
Review the network functions, ports, protocols, and services supported by the EDB Postgres Advanced Server. If any protocol is prohibited by the PPSM guidance and is enabled, this is a finding. Open "/pg_hba.conf" in a viewer. The default path for the postgresql data directory is /var/lib/edb/as/data (PGDATA), but this will vary according to local circumstances. If any rows have a TYPE that is "host" or "hostnossl", this is a finding. Execute the following SQL as "enterprisedb" operating system user: > psql edb -c "SHOW port" If the displayed port is not allowed, this is a finding.

Check Text ( C-63025r938909_chk )

Review the network functions, ports, protocols, and services supported by the EDB Postgres Advanced Server.

If any protocol is prohibited by the PPSM guidance and is enabled, this is a finding.

Open "/pg_hba.conf" in a viewer. The default path for the postgresql data directory is /var/lib/edb/as/data (PGDATA), but this will vary according to local circumstances. If any rows have a TYPE that is "host" or "hostnossl", this is a finding.

Execute the following SQL as "enterprisedb" operating system user:

> psql edb -c "SHOW port"

If the displayed port is not allowed, this is a finding.

Fix Text (F-62934r938910_fix)
Disable each prohibited network function, port, protocol, or service prohibited by the PPSM guidance. Open "pg_hba.conf" in an editor. The default path for the pg_hba.conf file is /var/lib/edb/as/data (PGDATA), but this will vary according to local circumstances. Change the TYPE of any rows not starting with a "#" to be either "local" or "hostssl". The METHOD for the local rows should be "peer", which will authenticate based on the operating system name. The METHOD for the hostssl rows should be one of these (in preferred order): cert, ldap, sspi, pam, or scram-sha-256. Execute the following SQL as "enterprisedb" operating system user: > psql edb -c "ALTER SYSTEM SET port = " Execute the following operating system command as the "root" user (or user with sudo privileges) to restart the postgres instance: > systemctl restart edb-as- Where is the major version of the EDB Postgres Advanced Server instance [e.g., 15].

Fix Text (F-62934r938910_fix)

Disable each prohibited network function, port, protocol, or service prohibited by the PPSM guidance.

Open "pg_hba.conf" in an editor. The default path for the pg_hba.conf file is /var/lib/edb/as/data (PGDATA), but this will vary according to local circumstances.

Change the TYPE of any rows not starting with a "#" to be either "local" or "hostssl". The METHOD for the local rows should be "peer", which will authenticate based on the operating system name. The METHOD for the hostssl rows should be one of these (in preferred order): cert, ldap, sspi, pam, or scram-sha-256.

Execute the following SQL as "enterprisedb" operating system user:

> psql edb -c "ALTER SYSTEM SET port = "

Execute the following operating system command as the "root" user (or user with sudo privileges) to restart the postgres instance:

> systemctl restart edb-as-

Where is the major version of the EDB Postgres Advanced Server instance [e.g., 15].