PostgreSQL DB Compliance Checks

Plugin ID: 148944

The PostgreSQL DB plugin connects to targets that host PostgreSQL databases. The plugin connects to the target, runs a query against the database, and evaluates the output for specific expressions.

Scan Requirements

Credentials

The plugin requires Database credentials with the “Database Type” of “PostgreSQL” for scanning.

Permissions

Tenable recommends running a database compliance scan with a user account having the following permissions or privileges:

• PostgreSQL v9.6:

  • Log in with an account that has the SUPERUSER role

    Example: >ALTER ROLE scan_user SUPERUSER;

• PostgreSQL v10+:

  • Log in with an account that has the pg_read_all_settings role.

    Example: GRANT pg_read_all_settings TO scan_user;

This ensures thorough scan results and reports because some system or hidden tables and parameters can only be accessed by an account with such high level privileges. These settings were obtained by testing Tenable’s published CIS and DISA STIG audits, which primarily target system databases and tables. Custom audits with user-created databases will require independent testing to achieve maximum results.

Checks

All PostgreSQL DB compliance checks must be bracketed with the check type encapsulation and the PostgreSQLDB designation. This is required to differentiate .audit files intended specifically for systems running PostgreSQL databases from other types of compliance audits.

See the following topics to learn more about the PostgreSQL DB plugin:

• PostgreSQL Audit Containers

• PostgreSQL Audit Items

• PostgreSQL Comments

• PostgreSQL SQL_POLICY Check

• PostgreSQL KB_VALUE Check

Notes

• If scans that utilize this plugin are not producing any compliance results, the following items should be checked:

  • Check that the credentials provided to the scan policy work from a remote host using a native SQL client.

  • Check the audit trail for the plugin that test for database login. For PostgreSQL, this would be plugin 91826 - PostgreSQL Server Login Possible.

  • Check the audit trail to see if there is a result for the compliance plugin . For PostgreSQL, this would be plugin 148944 - PostgreSQL DB Compliance Checks.