Ensure the PostgreSQL Audit Extension (pgAudit) is enabled

高等級 1自動化postgres

說明

The PostgreSQL Audit Extension (pgAudit) provides detailed session and/or object audit logging via the standard PostgreSQL logging facility. The goal of pgAudit is to provide PostgreSQL users with the capability to produce audit logs often required to comply with government, financial, or ISO certifications. Passes when pgaudit is in shared_preload_libraries and pgaudit.log selects at least one class. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

檢查方式

稽核方法: SQL 查詢

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT CASE WHEN 'pgaudit' = ANY (string_to_array(replace(current_setting('shared_preload_libraries'), ' ', ''), ',')) AND coalesce(current_setting('pgaudit.log', true), '') NOT IN ('', 'none') THEN 'compliant' ELSE 'noncompliant' END" 2>/dev/null) || exit 1; printf '%s\n' "$out"

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Install pgAudit (dnf install pgaudit_18 / apt install postgresql-18-pgaudit), add pgaudit to shared_preload_libraries (keep existing entries), set pgaudit.log (e.g. 'ddl,write') in postgresql.conf, restart PostgreSQL and run CREATE EXTENSION pgaudit;

屬性

作業系統: 不限
標籤: postgresdatabaseloggingaudit
參考資料: CIS PostgreSQL 18 Benchmark v1.0.0 - 3.2 Ensure the PostgreSQL Audit Extension (pgAudit) is enabled

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target postgres