PostgreSQL Log Connections Flag Should Be On
More Info:
PostgreSQL does not log attempted connections by default. Enabling the log_connections setting will create log entries for each attempted connection as well as successful completion of client authentication which can be useful in troubleshooting issues and to determine any unusual connection attempts to the server. This recommendation is applicable to PostgreSQL database instances.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP, CBP, SOC2, PCIDSS, NISTCSFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “PostgreSQL Log Connections Flag Should Be On” misconfiguration on GCP using the GCP console, follow these steps:
- Go to the GCP Console and select the project that contains the PostgreSQL instance that needs to be remediated.
- In the left navigation pane, select “SQL” under the “Storage” section.
- Select the PostgreSQL instance that needs to be remediated.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “Flags” section and click on the “Add Flag” button.
- In the “Name” field, enter “log_connections”.
- In the “Value” field, enter “on”.
- Click on the “Save” button at the bottom of the page to apply the changes.
- Wait for a few minutes for the changes to take effect.
Using CLI
Using CLI
To remediate the PostgreSQL Log Connections Flag Should Be On misconfiguration for GCP using GCP CLI, follow these steps:
- Open the Cloud Shell in the GCP Console.
-
Run the following command to list the available PostgreSQL instances in your project:
- Note down the instance name of the PostgreSQL instance you want to remediate.
-
Run the following command to enable the log_connections flag for the PostgreSQL instance:
Replace [INSTANCE_NAME] with the name of your PostgreSQL instance.
-
Confirm that the log_connections flag has been enabled by running the following command:
Replace [INSTANCE_NAME] with the name of your PostgreSQL instance. The output should show that the log_connections flag is set to “on”.
- Your PostgreSQL instance is now remediated with the log_connections flag enabled.
Using Python
Using Python
To remediate the PostgreSQL log connections flag misconfiguration in GCP using Python, follow these steps:
-
Install the
google-cloud-secret-managerandgoogle-authPython libraries using pip: -
Import the necessary libraries and authenticate to the GCP project:
Replace
/path/to/key.jsonwith the path to your GCP service account key file. -
Retrieve the value of the
postgres-configsecret: -
Update the
postgresql.conffile to enable logging of connections: -
Write the updated configuration back to the secret:
This will update the
postgres-configsecret with the new configuration that enables logging of connections. -
Verify that the configuration was updated successfully by checking the
postgresql.conffile on the PostgreSQL server.The output should beon.