The vCenter PostgreSQL service must log all client disconnections.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259184 | VCPG-80-000114 | SV-259184r935456_rule | CCI-000172 | medium |
| Description | ||||
| Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged. For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to PostgreSQL lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. | ||||
| STIG | Date | |||
| VMware vSphere 8.0 vCenter Appliance PostgreSQL Security Technical Implementation Guide | 2023-10-29 | |||
Details
Check Text (C-259184r935456_chk)
At the command prompt, run the following command:
# /opt/vmware/vpostgres/current/bin/psql -U postgres -A -t -c "SHOW log_disconnections;"
Expected result:
on
If the output does not match the expected result, this is a finding.
Fix Text (F-62833r935455_fix)
A script is included with vCenter to generate a PostgreSQL STIG configuration.
At the command prompt, run the following commands:
# chmod +x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py
# /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py --action stig_enable --pg-data-dir /storage/db/vpostgres
# chmod -x /opt/vmware/vpostgres/current/bin/vmw_vpg_config/vmw_vpg_config.py
Restart the PostgreSQL service by running the following command:
# vmon-cli --restart vmware-vpostgres