MariaDB must generate audit records when successful logons or connections occur.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-253764 | MADB-10-011200 | SV-253764r961824_rule | CCI-000172 | medium |
| Description | ||||
| For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to the DBMS. | ||||
| STIG | Date | |||
| MariaDB Enterprise 10.x Security Technical Implementation Guide | 2024-12-05 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AU-12
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.3.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.3.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000172
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-253764r961824_chk)
Check what filters are in place by running the following as an administrative user:
MariaDB> SELECT * FROM mysql.server_audit_filters;
Verify connect_events include connect in audit filters. If not, this is a finding.
Log in to and out of the MariaDB database server. Verify the connect is logged in the audit logfile or syslog depending on how it is configured.
If connect is not logged this is a finding.
Fix Text (F-57167r841816_fix)
Edit the necessary filters to include connect_events connect. Example:
MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';
MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('default',
JSON_COMPACT(
'{
"connect_event": [
"CONNECT",
"DISCONNECT"
]
}'
));