Cispostgresql14benchmarkv100docx Cis Instant Download
Cispostgresql14benchmarkv100docx Cis Instant Download
https://ebookbell.com/product/cispostgresql14benchmarkv100docx-
cis-47921646
https://ebookbell.com/product/cis-debian-
linux-11-benchmark-v100-center-for-internet-security-51753768
Cis Dideen Kat When The Plumes Rise The Way Of The Lake Babine Nation
Betty Patrick
https://ebookbell.com/product/cis-dideen-kat-when-the-plumes-rise-the-
way-of-the-lake-babine-nation-betty-patrick-5557424
https://ebookbell.com/product/cistransgene-optimization-1st-ed-saeid-
kadkhodaei-farahnaz-sadat-golestan-hashemi-7150894
https://ebookbell.com/product/retracing-the-aurochs-history-
morphology-ecology-of-an-extinct-wild-ox-cis-van-vuure-1628426
Cis The Us 37mm Gun In World War Ii Chuck C Roberts
https://ebookbell.com/product/cis-the-us-37mm-gun-in-world-war-ii-
chuck-c-roberts-57501916
https://ebookbell.com/product/cis-critical-security-controls-8th-
edition-center-for-internet-security-42476860
https://ebookbell.com/product/cis-microsoft-windows-10-enterprise-
release-1909-benchmark-180-center-for-internet-security-10666140
https://ebookbell.com/product/servicenow-cisitsm-information-
technology-service-management-12-practice-exams-muhammad-zeeshan-
ali-50322866
The Cis Critical Security Controls For Effective Cyber Defense Version
60 Center For Internet Security
https://ebookbell.com/product/the-cis-critical-security-controls-for-
effective-cyber-defense-version-60-center-for-internet-
security-6827850
CIS PostgreSQL 14 Benchmark
v1.0.0 - 10-27-2021
Terms of Use
Please see the below link for our current terms of use:
https://www.cisecurity.org/cis-securesuite/cis-securesuite-membership-terms-of-use/
1|Page
Table of Contents
2|Page
3.1.13 Ensure the program name for PostgreSQL syslog messages is correct
(Automated) ......................................................................................................................................... 44
3.1.14 Ensure the correct messages are written to the server log (Automated) ... 46
3.1.15 Ensure the correct SQL statements generating errors are recorded
(Automated) ......................................................................................................................................... 48
3.1.16 Ensure 'debug_print_parse' is disabled (Automated) .......................................... 50
3.1.17 Ensure 'debug_print_rewritten' is disabled (Automated) .................................. 52
3.1.18 Ensure 'debug_print_plan' is disabled (Automated) ............................................. 54
3.1.19 Ensure 'debug_pretty_print' is enabled (Automated) .......................................... 56
3.1.20 Ensure 'log_connections' is enabled (Automated) ................................................. 58
3.1.21 Ensure 'log_disconnections' is enabled (Automated) .......................................... 60
3.1.22 Ensure 'log_error_verbosity' is set correctly (Automated) ................................ 62
3.1.23 Ensure 'log_hostname' is set correctly (Automated) ............................................ 64
3.1.24 Ensure 'log_line_prefix' is set correctly (Automated)........................................... 66
3.1.25 Ensure 'log_statement' is set correctly (Automated) ........................................... 69
3.1.26 Ensure 'log_timezone' is set correctly (Automated) ............................................. 72
3.2 Ensure the PostgreSQL Audit Extension (pgAudit) is enabled (Automated) ... 74
4 User Access and Authorization ............................................................................................................... 77
4.1 Ensure sudo is configured correctly (Manual) .............................................................. 77
4.2 Ensure excessive administrative privileges are revoked (Manual)...................... 79
4.3 Ensure excessive function privileges are revoked (Automated) ........................... 82
4.4 Ensure excessive DML privileges are revoked (Manual) .......................................... 85
4.5 Ensure Row Level Security (RLS) is configured correctly (Manual) .................... 90
4.6 Ensure the set_user extension is installed (Automated) ........................................... 94
4.7 Make use of predefined roles (Manual) ......................................................................... 101
5 Connection and Login............................................................................................................................... 104
5.1 Ensure login via "local" UNIX Domain Socket is configured correctly (Manual)
................................................................................................................................................................. 104
5.2 Ensure login via "host" TCP/IP Socket is configured correctly (Manual) ....... 108
6 PostgreSQL Settings .................................................................................................................................. 112
6.1 Understanding attack vectors and runtime parameters (Manual) .................... 112
3|Page
6.2 Ensure 'backend' runtime parameters are configured correctly (Automated)
................................................................................................................................................................. 114
6.3 Ensure 'Postmaster' Runtime Parameters are Configured (Manual) ............... 116
6.4 Ensure 'SIGHUP' Runtime Parameters are Configured (Manual) ....................... 119
6.5 Ensure 'Superuser' Runtime Parameters are Configured (Manual).................. 123
6.6 Ensure 'User' Runtime Parameters are Configured (Manual) ............................. 126
6.7 Ensure FIPS 140-2 OpenSSL Cryptography Is Used (Automated) ..................... 130
6.8 Ensure TLS is enabled and configured correctly (Automated) ........................... 133
6.9 Ensure the pgcrypto extension is installed and configured correctly (Manual)
................................................................................................................................................................. 137
7 Replication .................................................................................................................................................... 140
7.1 Ensure a replication-only user is created and used for streaming replication
(Manual) .............................................................................................................................................. 140
7.2 Ensure logging of replication commands is configured (Manual) ..................... 143
7.3 Ensure base backups are configured and functional (Manual) ........................... 145
7.4 Ensure WAL archiving is configured and functional (Automated) .................... 147
7.5 Ensure streaming replication parameters are configured correctly (Manual)
................................................................................................................................................................. 149
8 Special Configuration Considerations ............................................................................................... 151
8.1 Ensure PostgreSQL configuration files are outside the data cluster (Manual)
................................................................................................................................................................. 151
8.2 Ensure PostgreSQL subdirectory locations are outside the data cluster
(Manual) .............................................................................................................................................. 154
8.3 Ensure the backup and restore tool, 'pgBackRest', is installed and configured
(Automated) ...................................................................................................................................... 156
8.4 Ensure miscellaneous configuration settings are correct (Manual) ................. 160
Appendix: Recommendation Summary Table ....................................................................................... 162
Appendix: Change History .............................................................................................................................. 165
4|Page
Overview
This document, CIS PostgreSQL 14 Benchmark, provides prescriptive guidance for
establishing a secure configuration posture for PostgreSQL 14. This guide was tested
against PostgreSQL 14 running on RHEL 8, but applies to other Linux distributions as well.
To obtain the latest version of this guide, please visit http://benchmarks.cisecurity.org. If
you have questions, comments, or have identified ways to improve this guide, please write
us at [email protected].
Intended Audience
This document is intended for system and application administrators, security specialists,
auditors, help desk, and platform deployment personnel who plan to develop, deploy,
assess, or secure solutions that incorporate PostgreSQL 14.
Consensus Guidance
This benchmark was created using a consensus review process comprised of subject
matter experts. Consensus participants provide perspective from a diverse set of
backgrounds including consulting, software development, audit and compliance, security
research, operations, government, and legal.
Each CIS benchmark undergoes two phases of consensus review. The first phase occurs
during initial benchmark development. During this phase, subject matter experts convene
to discuss, create, and test working drafts of the benchmark. This discussion occurs until
consensus has been reached on benchmark recommendations. The second phase begins
after the benchmark has been published. During this phase, all feedback provided by the
Internet community is reviewed by the consensus team for incorporation in the
benchmark. If you are interested in participating in the consensus process, please visit
https://workbench.cisecurity.org/.
5|Page
Typographical Conventions
The following typographical conventions are used throughout this guide:
Convention Meaning
Stylized Monospace font Used for blocks of code, command, and script examples.
Text should be interpreted exactly as presented.
Monospace font Used for inline code, commands, or examples. Text should
be interpreted exactly as presented.
<italic font in brackets> Italic texts set in angle brackets denote a variable
requiring substitution for a real value.
Assessment Status
An assessment status is included for every recommendation. The assessment status
indicates whether the given recommendation can be automated or requires manual steps
to implement. Both statuses are equally important and are determined and supported as
defined below:
Automated
Manual
6|Page
Profile Definitions
The following configuration profiles are defined by this Benchmark:
• Level 1 - PostgreSQL
Note: The intent of this profile is to include checks that can be assessed by remotely
connecting to PostgreSQL. Therefore, file system-related checks are not contained in
this profile.
Items in this profile apply to PostgreSQL 14 running on Linux and intend to:
7|Page
Acknowledgements
This benchmark exemplifies the great things a community of users, vendors, and subject matter
experts can accomplish through consensus collaboration. The CIS community thanks the entire
consensus team with special recognition to the following individuals who contributed greatly to
the creation of this guide:
Author
Douglas Hunley
Contributor
Emad Al-Mousa
Ross Moles
Editor
Tim Harrison Center for Internet Security
8|Page
Recommendations
1 Installation and Patches
One of the best ways to ensure PostgreSQL security is to implement security updates as
they come out, along with any applicable OS patches that will not interfere with system
operations. It is additionally prudent to ensure the installed version has not reached end-
of-life.
Description:
Standard Linux distributions, although possessing the requisite packages, often do not have
PostgreSQL pre-installed. The installation process includes installing the binaries and the
means to generate a data cluster. Package installation should include both the server and
client packages. Contribution modules are optional depending upon one's architectural
requirements (they are recommended though).
When obtaining and installing software packages (typically via dnf or apt), it's imperative
that packages are sourced only from valid and authorized repositories. For PostgreSQL, the
canonical repositories are the official PostgreSQL YUM repository (yum.postgresql.org) and
the official PostgreSQL APT repository (apt.postgresql.org). Your chosen PostgreSQL
vendor may offer its own software repositories as well.
Rationale:
Being open-source, PostgreSQL packages are widely available across the internet through
package aggregators and providers. However, using invalid or unauthorized sources for
packages can lead to implementing untested, defective, or malicious software.
9|Page
From a security perspective, it's imperative to verify the PostgreSQL binary packages are
sourced from a valid software repository. For a complete listing of all PostgreSQL binaries
available via configured repositories inspect the output from dnf provides '*libpq.so'
or apt-file search /usr/pgsql-14/lib/libpq.so.5.
Audit:
Identify and inspect configured repositories to ensure they are all valid and authorized
sources of packages. The following is an example of a simple CentOS 8 install illustrating
the use of the dnf repolist all command.
# whoami
root
# dnf repolist all | grep -E 'enabled$'
rhel-8-for-x86_64-appstream-rpms Red Hat Enterpris
enabled
rhel-8-for-x86_64-baseos-rpms Red Hat Enterpris
enabled
#
To inspect what versions of PostgreSQL packages are currently installed, we can query
using the rpm commands. As illustrated below, no PostgreSQL packages are installed:
# whoami
root
# rpm -qa | grep postgres
#
If packages were returned in the above, we can determine from which repo they came by
combining dnf and rpm:
# whoami
root
# dnf info $(rpm -qa|grep postgres) | grep -E '^Name|^Version|^From'
Name : postgresql14
Version : 14.0
From repo : pgdg14
Name : postgresql14-contrib
Version : 14.0
From repo : pgdg14
Name : postgresql14-libs
Version : 14.0
From repo : pgdg14
Name : postgresql14-server
Version : 14.0
From repo : pgdg14
10 | P a g e
If the expected binary packages are not installed, are not the expected versions, or did not
come from an appropriate repo, this is a fail.
Remediation:
Alter the configured repositories so they only include valid and authorized sources of
packages.
As an example of adding an authorized repository, we will install the PGDG repository RPM
from 'yum.postgresql.org' (note that because of a change in the way packaging is handled in
RHEL 8, we also need to disable the Red Hat built-in PostgreSQL module):
# whoami
root
# dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-8-
x86_64/pgdg-redhat-repo-latest.noarch.rpm
Last metadata expiration check: 0:01:35 ago on Fri 04 Oct 2019 01:19:37 PM
EDT.
[snip]
Installed:
pgdg-redhat-repo-42.0-19.noarch
Complete!
# dnf -qy module disable postgresql
# whoami
root
# dnf repolist all | egrep 'enabled$'
pgdg-common PostgreSQL common
enabled
pgdg10 PostgreSQL 10 for
enabled
pgdg11 PostgreSQL 11 for
enabled
pgdg12 PostgreSQL 12 for
enabled
pgdg13 PostgreSQL 13 for
enabled
pgdg14 PostgreSQL 14 for
enabled
pgdg96 PostgreSQL 9.6 fo
enabled
rhel-8-for-x86_64-appstream-rpms Red Hat Enterpris
enabled
rhel-8-for-x86_64-baseos-rpms Red Hat Enterpris
enabled
If the version of PostgreSQL installed is not 14.x or they did not come from a valid
repository, the packages may be uninstalled using this command:
11 | P a g e
# whoami
root
# dnf remove $(rpm -qa|grep postgres)
# whoami
root
# dnf install -y postgresql14-{server,contrib}
<snip>
Installed:
lz4-1.8.3-3.el8_4.x86_64 postgresql14-14.0-
1PGDG.rhel8.x86_64
postgresql14-contrib-14.0-1PGDG.rhel8.x86_64 postgresql14-libs-14.0-
1PGDG.rhel8.x86_64
postgresql14-server-14.0-1PGDG.rhel8.x86_64
Complete!
References:
1. https://en.wikipedia.org/wiki/DNF_(software)
2. https://en.wikipedia.org/wiki/APT_(software)
3. https://yum.postgresql.org
4. https://apt.postgresql.org
CIS Controls:
Controls
Control IG 1 IG 2 IG 3
Version
12 | P a g e
1.2 Ensure systemd Service Files Are Enabled (Automated)
Profile Applicability:
Description:
Rationale:
Enabling the systemd service on the OS ensures the database service is active when a
change of state occurs as in the case of a system startup or reboot.
Audit:
$ whoami
root
$ systemctl get-default
multi-user.target
$ systemctl list-dependencies multi-user.target | grep -i postgres
If the intended PostgreSQL service is not registered as a dependency (or "want") of the
default target (no output for the 3rd command above), this is a fail.
Remediation:
# whoami
root
# systemctl enable postgresql-14
Created symlink /etc/systemd/system/multi-user.target.wants/postgresql-
14.service → /usr/lib/systemd/system/postgresql-14.service.
# systemctl list-dependencies multi-user.target | grep -i postgres
● ├─postgresql-14.service
References:
1. https://man7.org/linux/man-pages/man1/systemctl.1.html
13 | P a g e
2. https://www.freedesktop.org/software/systemd/man/systemd.special.html
CIS Controls:
Controls
Control IG 1 IG 2 IG 3
Version
14 | P a g e
1.3 Ensure Data Cluster Initialized Successfully (Automated)
Profile Applicability:
Description:
Rationale:
For the purposes of security, PostgreSQL enforces ownership and permissions of the data
cluster such that:
• An initialized data cluster is owned by the UNIX account that created it.
• The data cluster cannot be accessed by other UNIX user accounts.
• The data-cluster cannot be created or owned by root
• The PostgreSQL process cannot be invoked by root nor any UNIX user account
other than the owner of the data cluster.
Audit:
Assuming you are installing the PostgreSQL binary package from the PGDG repository, the
standard method, as root, is to instantiate the cluster thusly:
# whoami
root
# PGSETUP_INITDB_OPTIONS="-k" /usr/pgsql-14/bin/postgresql-14-setup initdb
Initializing database ... OK
A correctly installed data cluster possesses directory permissions similar to the following
example. Otherwise, the service will fail to start:
# whoami
root
# ls -la ~postgres/14
total 8
drwx------. 4 postgres postgres 51 Oct 4 14:01 .
drwx------. 3 postgres postgres 37 Oct 4 13:54 ..
drwx------. 2 postgres postgres 6 Oct 1 06:18 backups
drwx------. 20 postgres postgres 4096 Oct 4 14:01 data
-rw-------. 1 postgres postgres 923 Oct 4 14:01 initdb.log
15 | P a g e
You can verify the PGDATA has sane permissions and attributes by running:
# whoami
postgres
# /usr/pgsql-14/bin/postgresql-14-check-db-dir ~postgres/14/data
# echo $?
0
Remediation:
# whoami
root
# PGSETUP_INITDB_OPTIONS="-k" /usr/pgsql-14/bin/postgresql-14-setup initdb
Data directory is not empty!
In the case of a cluster instantiation failure, one must delete/remove the entire data cluster
directory and repeat the initdb command:
# whoami
root
# rm -rf ~postgres/14
# PGSETUP_INITDB_OPTIONS="-k" /usr/pgsql-13/bin/postgresql-13-setup initdb
Initializing database ... OK
References:
1. https://www.postgresql.org/docs/current/app-initdb.html
CIS Controls:
Controls
Control IG 1 IG 2 IG 3
Version
16 | P a g e
Random documents with unrelated
content Scribd suggests to you:
The Project Gutenberg eBook of Birds of a
Feather
This ebook is for the use of anyone anywhere in the United States
and most other parts of the world at no cost and with almost no
restrictions whatsoever. You may copy it, give it away or re-use it
under the terms of the Project Gutenberg License included with this
ebook or online at www.gutenberg.org. If you are not located in the
United States, you will have to check the laws of the country where
you are located before using this eBook.
Language: English
By ROBERT SILVERBERG
Illustrated by WOOD
It was our first day of recruiting on the planet, and the alien life-
forms had lined up for hundreds of feet back from my rented office.
As I came down the block from the hotel, I could hear and see and
smell them with ease.
My three staff men, Auchinleck, Stebbins and Ludlow, walked
shieldwise in front of me. I peered between them to size the crop
up. The aliens came in every shape and form, in all colors and
textures—and all of them eager for a Corrigan contract. The Galaxy
is full of bizarre beings, but there's barely a species anywhere that
can resist the old exhibitionist urge.
"Send them in one at a time," I told Stebbins. I ducked into the
office, took my place back of the desk and waited for the procession
to begin.
The name of the planet was MacTavish IV (if you went by the official
Terran listing) or Ghryne (if you called it by what its people were
accustomed to calling it). I thought of it privately as MacTavish IV
and referred to it publicly as Ghryne. I believe in keeping the locals
happy wherever I go.
Through the front window of the office, I could see our big gay
tridim sign plastered to a facing wall: WANTED—
EXTRATERRESTRIALS! We had saturated MacTavish IV with our
promotional poop for a month preceding arrival. Stuff like this:
Want to visit Earth—see the Galaxy's most glittering and
exclusive world? Want to draw good pay, work short
hours, experience the thrills of show business on romantic
Terra? If you are a non-terrestrial, there may be a place
for you in the Corrigan Institute of Morphological Science.
No freaks wanted—normal beings only. J. F. Corrigan will
hold interviews in person on Ghryne from Thirdday to
Fifthday of Tenmonth. His last visit to the Caledonia
Cluster until 2937, so don't miss your chance! Hurry! A life
of wonder and riches can be yours!
It was the isolationism of the late 29th century that turned me into
the successful proprietor of Corrigan's Institute, after some years as
an impoverished carnival man in the Betelgeuse system. Back in
2903, the World Congress declared Terra off-bounds for non-
terrestrial beings, as an offshoot of the Terra for Terrans movement.
Before then, anyone could visit Earth. After the gate clanged down,
a non-terrestrial could only get onto Sol III as a specimen in a
scientific collection—in short, as an exhibit in a zoo.
That's what the Corrigan Institute of Morphological Science really is,
of course. A zoo. But we don't go out and hunt for our specimens;
we advertise and they come flocking to us. Every alien wants to see
Earth once in his lifetime, and there's only one way he can do it.
We don't keep too big an inventory. At last count, we had 690
specimens before this trip, representing 298 different intelligent life-
forms. My goal is at least one member of at least 500 different
races. When I reach that, I'll sit back and let the competition catch
up—if it can.
After an hour of steady work that morning, we had signed eleven
new specimens. At the same time, we had turned away a dozen
ursinoids, fifty of the reptilian natives of Ghryne, seven Sirian
spiders, and no less than nineteen chlorine-breathing Procyonites
wearing gas masks.
It was also my sad duty to nix a Vegan who was negotiating through
a Ghrynian agent. A Vegan would be a top-flight attraction, being
some 400 feet long and appropriately fearsome to the eye, but I
didn't see how we could take one on. They're gentle and likable
beings, but their upkeep runs into literally tons of fresh meat a day,
and not just any old kind of meat either. So we had to do without
the Vegan.
"One more specimen before lunch," I told Stebbins, "to make it an
even dozen."
He looked at me queerly and nodded. A being entered. I took a long
close look at the life-form when it came in, and after that I took
another one. I wondered what kind of stunt was being pulled. So far
as I could tell, the being was quite plainly nothing but an Earthman.
He sat down facing me without being asked and crossed his legs. He
was tall and extremely thin, with pale blue eyes and dirty-blond hair,
and though he was clean and reasonably well dressed, he had a
shabby look about him. He said, in level Terran accents, "I'm looking
for a job with your outfit, Corrigan."
"There's been a mistake. We're interested in non-terrestrials only."
"I'm a non-terrestrial. My name is Ildwar Gorb, of the planet
Wazzenazz XIII."
I don't mind conning the public from time to time, but I draw the
line at getting bilked myself. "Look, friend, I'm busy, and I'm not
known for my sense of humor. Or my generosity."
"I'm not panhandling. I'm looking for a job."
"Then try elsewhere. Suppose you stop wasting my time, bud. You're
as Earthborn as I am."
"I've never been within a dozen parsecs of Earth," he said smoothly.
"I happen to be a representative of the only Earthlike race that
exists anywhere in the Galaxy but on Earth itself. Wazzenazz XIII is a
small and little-known planet in the Crab Nebula. Through an
evolutionary fluke, my race is identical with yours. Now, don't you
want me in your circus?"
"No. And it's not a circus. It's—"
"A scientific institute. I stand corrected."
There was something glib and appealing about this preposterous
phony. I guess I recognized a kindred spirit or I would have tossed
him out on his ear without another word. Instead I played along. "If
you're from such a distant place, how come you speak English so
well?"
"I'm not speaking. I'm a telepath—not the kind that reads minds,
just the kind that projects. I communicate in symbols that you
translate back to colloquial speech."
"Very clever, Mr. Gorb." I grinned at him and shook my head. "You
spin a good yarn—but for my money, you're really Sam Jones or Phil
Smith from Earth, stranded here and out of cash. You want a free
trip back to Earth. No deal. The demand for beings from Wazzenazz
XIII is pretty low these days. Zero, in fact. Good-by, Mr. Gorb."
He pointed a finger squarely at me and said, "You're making a big
mistake. I'm just what your outfit needs. A representative of a
hitherto utterly unknown race identical to humanity in every respect!
Look here, examine my teeth. Absolutely like human teeth! And—"
I pulled away from his yawning mouth. "Good-by, Mr. Gorb," I
repeated.
"All I ask is a contract, Corrigan. It isn't much. I'll be a big attraction.
I'll—"
"Good-by, Mr. Gorb!"
He glowered at me reproachfully for a moment, stood up and
sauntered to the door. "I thought you were a man of acumen,
Corrigan. Well, think it over. Maybe you'll regret your hastiness. I'll
be back to give you another chance."
He slammed the door and I let my grim expression relax into a
smile. This was the best con switch yet—an Earthman posing as an
alien to get a job!
But I wasn't buying it, even if I could appreciate his cleverness
intellectually. There's no such place as Wazzenazz XIII and there's
only one human race in the Galaxy—on Earth. I was going to need
some real good reason before I gave a down-and-out grifter a free
ticket home.
I didn't know it then, but before the day was out, I would have that
reason. And, with it, plenty of trouble on my hands.
About fifty more applicants were processed without a hitch. Then life
started to get complicated again.
Nine of the fifty were okay. The rest were unacceptable for one
reason or another, and they took the bad news quietly enough. The
haul for the day so far was close to two dozen new life-forms under
contract.
I had just about begun to forget about the incidents of the
Kallerian's outraged pride and the Stortulian's flighty wife when the
door opened and the Earthman who called himself Ildwar Gorb of
Wazzenazz XIII stepped in.
"How did you get in here?" I demanded.
"Your man happened to be looking the wrong way," he said cheerily.
"Change your mind about me yet?"
"Get out before I have you thrown out."
Gorb shrugged. "I figured you hadn't changed your mind, so I've
changed my pitch a bit. If you won't believe I'm from Wazzenazz
XIII, suppose I tell you that I am Earthborn, and that I'm looking for
a job on your staff."
"I don't care what your story is! Get out or—"
"—you'll have me thrown out. Okay, okay. Just give me half a
second. Corrigan, you're no fool, and neither am I—but that fellow
of yours outside is. He doesn't know how to handle alien beings.
How many times today has a life-form come in here unexpectedly?"
I scowled at him. "Too damn many."
"You see? He's incompetent. Suppose you fire him, take me on
instead. I've been living in the outworlds half my life; I know all
there is to know about alien life-forms. You can use me, Corrigan."
I took a deep breath and glanced all around the paneled ceiling of
the office before I spoke. "Listen, Gorb, or whatever your name is,
I've had a hard day. There's been a Kallerian in here who just about
threatened murder, and there's been a Stortulian in here who's
about to commit suicide because of me. I have a conscience and it's
troubling me. But get this: I just want to finish off my recruiting,
pack up and go home to Earth. I don't want you hanging around
here bothering me. I'm not looking to hire new staff members, and if
you switch back to claiming you're an unknown life-form from
Wazzenazz XIII, the answer is that I'm not looking for any of those
either. Now will you scram or—"
The office door crashed open at that point and Heraal, the Kallerian,
came thundering in. He was dressed from head to toe in glittering
metalfoil, and instead of his ceremonial blaster, he was wielding a
sword the length of a human being. Stebbins and Auchinleck came
dragging helplessly along in his wake, hanging desperately to his
belt.
"Sorry, Chief," Stebbins gasped. "I tried to keep him out, but—"
Heraal, who had planted himself in front of my desk, drowned him
out with a roar. "Earthman, you have mortally insulted the Clan
Gursdrinn!"
Sitting with my hands poised near the meshgun trigger, I was ready
to let him have it at the first sight of actual violence.
Heraal boomed, "You are responsible for what is to happen now. I
have notified the authorities and you prosecuted will be for causing
the death of a life-form! Suffer, Earthborn ape! Suffer!"
"Watch it, Chief," Stebbins yelled. "He's going to—"
An instant before my numb fingers could tighten on the meshgun
trigger, Heraal swung that huge sword through the air and plunged it
savagely through his body. He toppled forward onto the carpet with
the sword projecting a couple of feet out of his back. A few driblets
of bluish-purple blood spread from beneath him.
Before I could react to the big life-form's hara-kiri, the office door
flew open again and three sleek reptilian beings entered, garbed in
the green sashes of the local police force. Their golden eyes goggled
down at the figure on the floor, then came to rest on me.
"You are J. F. Corrigan?" the leader asked.
"Y-yes."
"We have received word of a complaint against you. Said complaint
being—"
"—that your unethical actions have directly contributed to the
untimely death of an intelligent life-form," filled in the second of the
Ghrynian policemen.
"The evidence lies before us," intoned the leader, "in the cadaver of
the unfortunate Kallerian who filed the complaint with us several
minutes ago."
"And therefore," said the third lizard, "it is our duty to arrest you for
this crime and declare you subject to a fine of no less than $100,000
Galactic or two years in prison."
"Hold on!" I stormed. "You mean that any being from anywhere in
the Universe can come in here and gut himself on my carpet, and
I'm responsible?"
"This is the law. Do you deny that your stubborn refusal to yield to
this late life-form's request lies at the root of his sad demise?"
"Well, no, but—"
"Failure to deny is admission of guilt. You are guilty, Earthman."
Before the police could interfere, Gorb trotted over to the hulking
corpse of the Kallerian and fetched it a mighty kick.
"Wake up, you faker! Stop playing possum and stand up! You aren't
fooling anyone!"
Welcome to our website – the perfect destination for book lovers and
knowledge seekers. We believe that every book holds a new world,
offering opportunities for learning, discovery, and personal growth.
That’s why we are dedicated to bringing you a diverse collection of
books, ranging from classic literature and specialized publications to
self-development guides and children's books.
ebookbell.com