V-261909
Crunchy Data Postgres 16 Security Technical Implementation Guide
Title
PostgreSQL must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA), and database administrator (DBA).
Description
<VulnDiscussion>If the DBMS provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. Some default PostgreSQL error messages can contain information that could aid ...
Fix Text (Documentation Requirement)
Note: The following instructions use the PGDATA environment variable. Refer to APPENDIX-F for instructions on configuring PGDATA. To set the level of detail for error messages exposed to clients, as the DBA (shown here as "postgres"), run the following commands: $ sudo su - postgres $ vi ${PGDATA?}/postgresql.conf client_min_messages = error