OpenControls Logo

STIG Viewer

STIGViewer Support

The MySQL Database Server 8.0 must map the PKI-authenticated identity to an associated user account.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-235136MYS8-00-004900SV-235136r961044_ruleCCI-000187medium
Description
The DoD standard for authentication is DoD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to a Database Management System (DBMS) user account for the authenticated identity to be meaningful to the DBMS and useful for authorization decisions.
STIGDate
Oracle MySQL 8.0 Security Technical Implementation Guide2024-09-04

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (69) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00

+59 more (top 10 by confidence shown)

CCI1 mapping
CCI-000187
1.00

Details

Check Text (C-235136r961044_chk)

Review MySQL Database Server 8.0 configuration to verify DBMS user accounts are being mapped directly to unique identifying information within the validated PKI certificate. Confirm Issuer and Subject map to the username. Run the following script: SELECT `user`.`Host`, `user`.`User`, `user`.`ssl_type`, CAST(`user`.`x509_issuer` as CHAR) as Issuer, CAST(`user`.`x509_subject` as CHAR) as Subject FROM `mysql`.`user`; If user accounts are not being mapped to authenticated identities, this is a finding.

Fix Text (F-38318r623529_fix)

Configure the MySQL Database Server 8.0 to map the authenticated identity directly to the MySQL Database Server 8.0 user account. Alter users to require X509 certificates. Below is an example to add X509 as a requirement. For a new user: CREATE USER 'jeffrey'@'localhost' REQUIRE X509; AND SUBJECT '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Johan Smith' AND ISSUER '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Some CA'; Or to add to an existing user: ALTER USER 'johansmith'@'%' REQUIRE X509 AND SUBJECT '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Johan Smith' AND ISSUER '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Some CA';