Checklist Summary:

The PostgreSQL 9.x on Red Hat Enterprise Linux Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. This document is meant for use in conjunction with other STIGs such as the Enclave, Network Infrastructure, Secure Remote Computing, and appropriate Operating System (OS) STIGs. It is based on the Database Security Requirements Guide (SRG) Version 2 Release 6, which in turn derives its cybersecurity controls from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4. PostgreSQL (also known simply as Postgres) is an open-source, community-developed relational database management system, supported by the PostgreSQL Global Development Group. That body permits and encourages the modification, extension, and redistribution of its base product. One extension of importance to this STIG is pgAudit, also open-source and developed by a parallel organization. This STIG requires that the product be deployed on Red Hat Enterprise Linux (RHEL) to enable the use of NIST-certified cryptographic modules. While it can run and use cryptography on many versions of Linux, UNIX, and Windows, to guarantee that certified crypto modules are used by PostgreSQL, RHEL must be the operating system.

Checklist Role:

• Database Management System

Known Issues:

Not provided.

Target Audience:

Not provided.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoDI 8500.01.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Not provided.

Product Support:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Information Assurance Support Environment (IASE) website. This site contains the latest copies of any STIGs, SRGs, and other related security information. The address for the IASE site is http://iase.disa.mil/.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

Updated to FINAL - 09/08/2017
updated to v1,r2 - 02/16/2018
Updated to FINAL - 3/18/2018
updated to v1,r3 - 4/25/18
Updated to FINAL - 5/25/18
Updated to Ver 1, Rel 4 - 10/25/18
Updated to FINAL - 11/26/18
updated to v1,r5 - 4/30/19
Updated URLs - 6/13/19
updated URLs - 11/1/19
Updated URLs per DISA - 4/24/2020
Updated URL per DISA - 10/28/20
updated SHA - 11/5/2020
Updated resource per DISA - 7/29/21
null
Updated resource per DISA - 8/1/22
null
SHA - 10/13/22
updated URLs - 1/26/24
Updated resource - 08/15/2024

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 08/15/2024