EnterpriseDB Postgres Advanced Server (EPAS) STIG Hardening Checklist

Verify EPAS version and STIG applicability

Confirm product version and applicable STIG release before changes.

Install latest EPAS patches and updates

Apply vendor-supplied security patches and required updates.

Enable FIPS-compliant cryptography on the OS and libraries

Ensure OS is FIPS-enabled or use FIPS 140-2-certified OpenSSL libs.

Configure PostgreSQL authentication methods to use SCRAM or stronger

Avoid MD5; prefer SCRAM-SHA-256 or equivalent.

Configure password policy

Implement and enforce password complexity and lifecycle policies.

Set minimum password length to 12 characters

Require at least 12 chars to reduce brute-force risk.

Set password expiration to 90 days

Enforce periodic password changes per STIG guidance.

Restrict superuser access and review roles

Limit superuser accounts and audit role assignments regularly.

Enable and configure logging and audit settings

Capture authentication, DDL, and privilege changes in logs.

Set log level to capture security-relevant events

Adjust logging to record failed logins, role changes, and DDL.

Harden network access: restrict listen_addresses and update pg_hba.conf

Allow only required hosts, use CIDR restrictions and strong auth methods.

Disable or remove unnecessary extensions and features

Uninstall or disable extensions not required for operations.

Implement regular backups and verify restore process

Schedule backups and test restores to validate recoverability.

Apply OS-level hardening and set permissions for data directories

Harden host OS, restrict filesystem permissions for PG data and config files.

Document configuration and generate STIG compliance report

Record changes, rationale, and produce evidence for audits.