OpenControls Logo

STIG Viewer

STIGViewer Support

MariaDB must invalidate session identifiers upon user logout or other session termination.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253706MADB-10-004700SV-253706r1043179_ruleCCI-001185medium
Description
Captured sessions can be reused in replay attacks. This requirement limits the ability of adversaries to capture and continue to employ previously valid session IDs. This requirement focuses on communications protection for the MariaDB session rather than for the network packet. The intent of this control is to establish grounds for confidence at each end of a communications session in the ongoing identity of the other party and in the validity of the information being transmitted. Session IDs are tokens generated by MariaDB to uniquely identify a user's (or process's) session. MariaDB will make access decisions and execute logic based on the session ID. Unique session IDs help to reduce predictability of said identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. When a user logs out, or when any other session termination event occurs, the DBMS must terminate the user's session(s) to minimize the potential for sessions to be hijacked.
STIGDate
MariaDB Enterprise 10.x Security Technical Implementation Guide2026-03-02

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-09.1Invalidate Session Identifiers at Logout
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-12Session Termination
1.00
MA-4(7)Disconnect Verification
1.00
SC-23(1)Invalidate Session Identifiers at Logout
1.00
CCI1 mapping
CCI-001185
1.00

Details

Check Text (C-253706r1043179_chk)

As the database administrator, run the following SQL: MariaDB> SHOW GLOBAL VARIABLES LIKE 'tcp_keepalive_interval'; MariaDB> SHOW GLOBAL VARIABLES LIKE 'tcp_keepalive_probes'; MariaDB> SHOW GLOBAL VARIABLES LIKE 'tcp_keepalive_time'; MariaDB> SHOW GLOBAL VARIABLES LIKE 'tcp_nodelay'; MariaDB> SHOW GLOBAL VARIABLES LIKE 'max_statement_time'; If these settings are not set, this is a finding.

Fix Text (F-57109r841642_fix)

As the administrator locate the my.cnf file to change. For Centos, RedHat, and similar distributions this will be in /etc/my.cnf.d/. In the [mariadb] section add the lines: tcp_keepalive_interval == seconds https://mariadb.com/docs/reference/mdb/system-variables/tcp_keepalive_interval/ tcp_keepalive_probes == number of probes https://mariadb.com/docs/reference/mdb/system-variables/tcp_keepalive_probes/ tcp_keepalive_time == seconds https://mariadb.com/docs/reference/mdb/system-variables/tcp_keepalive_time/ tcp_nodelay == boolean (off or on) https://mariadb.com/docs/reference/mdb/system-variables/tcp_nodelay/ max_statement_time == seconds https://mariadb.com/docs/reference/mdb/system-variables/max_statement_time/