Ensure the backup and restore tool, 'pgBackRest', is installed and configured

LowLevel 1Automatedpostgres

Description

pgBackRest aims to be a simple, reliable backup and restore system that can seamlessly scale up to the largest databases and workloads. Instead of relying on traditional backup tools like tar and rsync, pgBackRest implements all backup features internally and uses a custom protocol for communicating with remote systems. Passes when the pgbackrest binary is installed and /etc/pgbackrest/pgbackrest.conf (or /etc/pgbackrest.conf) exists; an alternative backup tool makes this an accepted exception.

How it is checked

Audit method: Shell command

shell

command -v pgbackrest >/dev/null 2>&1 || { echo not-installed; exit 0; }; if [ -f /etc/pgbackrest/pgbackrest.conf ] || [ -f /etc/pgbackrest.conf ]; then echo compliant; else echo not-configured; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Install pgBackRest from PGDG (dnf install pgbackrest / apt install pgbackrest), configure /etc/pgbackrest/pgbackrest.conf (stanza, repository on separate storage, retention, logging), run pgbackrest --stanza=<name> stanza-create and test a restore.

Properties

Operating systems: Any
Tags: postgresdatabasebackup
Reference: CIS PostgreSQL 18 Benchmark v1.0.0 - 8.2 Ensure the backup and restore tool, 'pgBackRest', is installed and configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target postgres