Cis Azure Database 6.8
DevOps & Securitycis-azure-database-6.8Cis Azure Database 6.8 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL servers
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Database_Services_Benchmark_v2.0.0/cis-azure-database-6.8/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-database-6-8, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
6.8 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL servers (Automated)
Profile Applicability
- Level 1
Description
Enable log_disconnections on PostgreSQL servers.
Rationale
Enabling log_disconnections helps PostgreSQL Database to logs end of a session, including duration, which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
Impact
Enabling this setting will enable a log of all disconnections. If this is enabled for a high traffic server, the log may grow exponentially.
Audit Procedure
Audit from Azure Portal
- Login to Azure Portal using https://portal.azure.com.
- Go to
Azure Database for PostgreSQL servers. - For each server, under
Settings, clickServer parameters. - Search for
log_disconnections. - Ensure that
log_disconnectionsis set toON.
Audit from Azure CLI
Ensure log_disconnections value is set to ON:
az postgres flexible-server parameter show --resource-group <resourceGroupName> --server-name <serverName> --name log_disconnections
Audit from PowerShell
Ensure log_disconnections value is set to ON:
Get-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <ResourceGroupName> -ServerName <ServerName> -Name log_disconnections
Audit from Azure Policy
Policy ID: 1d14b021-1bae-4f93-b36b-69695e14984a
Name: 'Disconnections should be logged for PostgreSQL flexible servers'
Expected Result
The log_disconnections server parameter should be set to ON.
Remediation
Remediate from Azure Portal
- Login to Azure Portal using https://portal.azure.com.
- Go to
Azure Database for PostgreSQL servers. - For each server, under
Settings, clickServer parameters. - Search for
log_disconnections. - Set
log_disconnectionstoON. - Click
Save.
Remediate from Azure CLI
Use the below command to update log_disconnections configuration:
az postgres flexible-server parameter set --resource-group <resourceGroupName> --server-name <serverName> --name log_disconnections --value on
Remediate from PowerShell
Use the below command to update log_disconnections configuration:
Update-AzPostgreSqlFlexibleServerConfiguration -ResourceGroupName <ResourceGroupName> -ServerName <ServerName> -Name log_disconnections -Value on
Default Value
By default, log_disconnections is disabled (set to off).
References
- https://docs.microsoft.com/en-us/rest/api/postgresql
- https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal
- https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation
- https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlconfiguration
- https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlconfiguration
Profile
- Level 1