lacework-global-547
Set server parameter 'connection_throttling' to 'ON' for PostgreSQL Database Server (Automated)
Profile Applicability
• Level 1
Description
Enable connection_throttling on PostgreSQL Servers.
Rationale
Enabling connection_throttling
helps the PostgreSQL Database to Set the verbosity of logged messages
. This in turn generates query and error logs with respect to concurrent connections that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
Audit
From Azure Portal
- Login to Azure Portal using https://portal.azure.com
- Go to
Azure Database
forPostgreSQL server
- For each database, click on
Server parameters
- Search for
connection_throttling
. - Ensure that value is set to
ON
.
From Azure CLI
Ensure connection_throttling
value is set to ON
az postgres server configuration show --resource-group <resourceGroupName> --server-name <serverName> --name connection_throttling
Remediation
From Azure Portal
- Login to Azure Portal using https://portal.azure.com.
- Go to
Azure Database for PostgreSQL servers
. - For each database, click
Server parameters
. - Search for
connection_throttling
. - Click
ON
and save.
From Azure CLI
Use the below command to update connection_throttling configuration.
az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name connection_throttling --value on
References
https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server
https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-4-enable-logging-for-azure-resources