Securing PostgreSQL - Exploring the PostgreSQL STIG and Beyond
summary
Postgres has an official Postgres STIG of 111 rules that targets RHEL7 and requires Postgres 9.5+ because many checks rely on PG Audit; the guide mandates FIPS‑compatible crypto, recommends SELinux MCS policy, and admits Postgres lacks native at‑rest encryption so filesystem encryption or application‑side crypto (pgcrypto) is required. Crunchy Data publishes an open‑source stig‑checker (Chef/inspec) that already checks about 80 rules. The STIG includes config examples for pg_hba.conf, SSL, and RLS time‑travel patterns.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:07Overview
- 3:53Operating System
- 9:00ClientServer Security
- 15:44Chronological Security
- 18:24History Tables
- 20:49STIG Overview
- 22:47Postgres STIG
- 25:31What is the PostgreSQL STIG
- 26:14PostgreSQL STIG Supplemental Guide
- 27:00Appendices
- 27:34Requirements
- 29:01Example Rule
- 29:44Severity Categories
- 30:40STIG Viewer
- 32:24Stink Checker
- 34:04Rule Title
- 35:25Related Configuration Items
- 36:40Other Security Related Configurations
- 41:11Connection
- 42:36User
- 43:31Authentication Methods
- 44:46Authentication Options
- 46:41Questions
related talks
50mSecuring PostgreSQL
50mPostgreSQL Security. How Do We Think?
07mAll about Postgres security
38mPostgreSQL and DevSecOps: Ensuring database security
54mConfiguration and Authentication
35mSecuring PostgreSQL From External Attack
32mEnhancing Security in PostgreSQL
28mFrom Dev to Prod: Securing Postgres the Right Way