EnterpriseDB Postgres Advanced Server (EPAS) STIG Hardening Checklist

15 items · Security · Hard difficulty · 3 hours

Practical EPAS STIG steps to harden Postgres for secure deployments.

• Verify EPAS version and STIG applicability

  Confirm product version and applicable STIG release before changes.

• Install latest EPAS patches and updates

  Apply vendor-supplied security patches and required updates.

• Enable FIPS-compliant cryptography on the OS and libraries

  Ensure OS is FIPS-enabled or use FIPS 140-2-certified OpenSSL libs.

• Configure PostgreSQL authentication methods to use SCRAM or stronger

  Avoid MD5; prefer SCRAM-SHA-256 or equivalent.

• Configure password policy

  Implement and enforce password complexity and lifecycle policies.

• Set minimum password length to 12 characters

  Require at least 12 chars to reduce brute-force risk.

• Set password expiration to 90 days

  Enforce periodic password changes per STIG guidance.

• Restrict superuser access and review roles

  Limit superuser accounts and audit role assignments regularly.

• Enable and configure logging and audit settings

  Capture authentication, DDL, and privilege changes in logs.

• Set log level to capture security-relevant events

  Adjust logging to record failed logins, role changes, and DDL.

• Harden network access: restrict listen_addresses and update pg_hba.conf

  Allow only required hosts, use CIDR restrictions and strong auth methods.

• Disable or remove unnecessary extensions and features

  Uninstall or disable extensions not required for operations.

• Implement regular backups and verify restore process

  Schedule backups and test restores to validate recoverability.

• Apply OS-level hardening and set permissions for data directories

  Harden host OS, restrict filesystem permissions for PG data and config files.

• Document configuration and generate STIG compliance report

  Record changes, rationale, and produce evidence for audits.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.