MADB-10-000100 - MariaDB must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

CAT|III

CCI|CCI-000054

Rule-ID|SV-253666r841523_rule

STIG-ID|MADB-10-000100

Vuln-ID|V-253666

MADB-10-000200 - MariaDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-253667r841526_rule

STIG-ID|MADB-10-000200

Vuln-ID|V-253667

MADB-10-000300 - MariaDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

CCI|CCI-000213

Rule-ID|SV-253668r841529_rule

STIG-ID|MADB-10-000300

Vuln-ID|V-253668

MADB-10-000400 - MariaDB must protect against a user falsely repudiating having performed organization-defined actions.

CAT|II

CCI|CCI-000166

Rule-ID|SV-253669r841532_rule

STIG-ID|MADB-10-000400

Vuln-ID|V-253669

MADB-10-000500 - MariaDB must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.

CCI|CCI-000169

Rule-ID|SV-253670r841535_rule

STIG-ID|MADB-10-000500

Vuln-ID|V-253670

MADB-10-000600 - MariaDB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. - mysql.db

CCI|CCI-000171

Rule-ID|SV-253671r841538_rule

STIG-ID|MADB-10-000600

Vuln-ID|V-253671

MADB-10-000600 - MariaDB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. - mysql.tables_priv

MADB-10-000600 - MariaDB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. - mysql.user

MADB-10-000700 - MariaDB must be able to generate audit records when privileges/permissions are retrieved.

CCI|CCI-000172

Rule-ID|SV-253672r841541_rule

STIG-ID|MADB-10-000700

Vuln-ID|V-253672

MADB-10-000800 - MariaDB must be able to generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.

Rule-ID|SV-253673r841544_rule

STIG-ID|MADB-10-000800

Vuln-ID|V-253673

MADB-10-000900 - MariaDB must initiate session auditing upon startup.

CCI|CCI-001464

Rule-ID|SV-253674r841547_rule

STIG-ID|MADB-10-000900

Vuln-ID|V-253674

MADB-10-001000 - MariaDB must produce audit records containing sufficient information to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-253675r841550_rule

STIG-ID|MADB-10-001000

Vuln-ID|V-253675

MADB-10-001600 - MariaDB must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

CCI|CCI-000135

Rule-ID|SV-253676r841553_rule

STIG-ID|MADB-10-001600

Vuln-ID|V-253676

MADB-10-001700 - MariaDB must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

CCI|CCI-000140

Rule-ID|SV-253677r841556_rule

STIG-ID|MADB-10-001700

Vuln-ID|V-253677

MADB-10-001800 - MariaDB must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

Rule-ID|SV-253678r841559_rule

STIG-ID|MADB-10-001800

Vuln-ID|V-253678

MADB-10-002000 - The audit information produced by MariaDB must be protected from unauthorized read access.

CCI|CCI-000162

Rule-ID|SV-253679r841562_rule

STIG-ID|MADB-10-002000

Vuln-ID|V-253679

MADB-10-002100 - The audit information produced by MariaDB must be protected from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-253680r841565_rule

STIG-ID|MADB-10-002100

Vuln-ID|V-253680

MADB-10-002200 - The audit information produced by MariaDB must be protected from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-253681r841568_rule

STIG-ID|MADB-10-002200

Vuln-ID|V-253681

MADB-10-002300 - MariaDB must protect its audit features from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-253682r841571_rule

STIG-ID|MADB-10-002300

Vuln-ID|V-253682

MADB-10-002400 - MariaDB must protect its audit configuration from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-253683r841574_rule

STIG-ID|MADB-10-002400

Vuln-ID|V-253683

MADB-10-002500 - MariaDB must protect its audit features from unauthorized removal.

CCI|CCI-001495

Rule-ID|SV-253684r841577_rule

STIG-ID|MADB-10-002500

Vuln-ID|V-253684

MADB-10-002600 - MariaDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the DBMS.

CCI|CCI-001499

Rule-ID|SV-253685r841580_rule

STIG-ID|MADB-10-002600

Vuln-ID|V-253685

MADB-10-002700 - The MariaDB software installation account must be restricted to authorized users.

Rule-ID|SV-253686r841583_rule

STIG-ID|MADB-10-002700

Vuln-ID|V-253686

MADB-10-002800 - Database software, including MariaDB configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

Rule-ID|SV-253687r841586_rule

STIG-ID|MADB-10-002800

Vuln-ID|V-253687

MADB-10-002900 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MariaDB, etc.) must be owned by database/MariaDB principals authorized for ownership.

Rule-ID|SV-253688r841589_rule

STIG-ID|MADB-10-002900

Vuln-ID|V-253688

MADB-10-003000 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the MariaDB, etc.) must be restricted to authorized users.

Rule-ID|SV-253689r841860_rule

STIG-ID|MADB-10-003000

Vuln-ID|V-253689

MADB-10-003100 - Default demonstration and sample databases, database objects, and applications must be removed.

CCI|CCI-000381

Rule-ID|SV-253690r841595_rule

STIG-ID|MADB-10-003100

Vuln-ID|V-253690

MADB-10-003200 - Unused database components, DBMS software, and database objects must be removed.

Rule-ID|SV-253691r841598_rule

STIG-ID|MADB-10-003200

Vuln-ID|V-253691

MADB-10-003400 - Access to external executables must be disabled or restricted.

Rule-ID|SV-253692r841601_rule

STIG-ID|MADB-10-003400

Vuln-ID|V-253692

MADB-10-003500 - MariaDB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-253693r841604_rule

STIG-ID|MADB-10-003500

Vuln-ID|V-253693

MADB-10-003600 - MariaDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-253694r841607_rule

STIG-ID|MADB-10-003600

Vuln-ID|V-253694

MADB-10-003700 - If MariaDB authentication, using passwords, is employed, then MariaDB must enforce the DoD standards for password complexity.

CCI|CCI-000192

Rule-ID|SV-253695r841610_rule

STIG-ID|MADB-10-003700

Vuln-ID|V-253695

MADB-10-003750 - If MariaDB authentication using passwords is employed, MariaDB must enforce the DoD standards for password lifetime.

Rule-ID|SV-253696r841613_rule

STIG-ID|MADB-10-003750

Vuln-ID|V-253696

MADB-10-003800 - If passwords are used for authentication, MariaDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-253697r841616_rule

STIG-ID|MADB-10-003800

Vuln-ID|V-253697

MADB-10-003900 - If passwords are used for authentication, MariaDB must transmit only encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-253698r841619_rule

STIG-ID|MADB-10-003900

Vuln-ID|V-253698

MADB-10-004000 - MariaDB, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-253699r841622_rule

STIG-ID|MADB-10-004000

Vuln-ID|V-253699

MADB-10-004100 - MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.

CCI|CCI-000186

Rule-ID|SV-253700r841625_rule

STIG-ID|MADB-10-004100

Vuln-ID|V-253700

MADB-10-004200 - MariaDB must map PKI ID to an associated user account.

CCI|CCI-000187

Rule-ID|SV-253701r841628_rule

STIG-ID|MADB-10-004200

Vuln-ID|V-253701

MADB-10-004300 - MariaDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

CCI|CCI-000206

Rule-ID|SV-253702r841631_rule

STIG-ID|MADB-10-004300

Vuln-ID|V-253702

MADB-10-004400 - MariaDB must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations. - have_openssl

CCI|CCI-000803

Rule-ID|SV-253703r841634_rule

STIG-ID|MADB-10-004400

Vuln-ID|V-253703

MADB-10-004400 - MariaDB must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations. - libmysqlclient

MADB-10-004400 - MariaDB must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations. - version_ssl_library

MADB-10-004500 - The MariaDB must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

CCI|CCI-000804

Rule-ID|SV-253704r841637_rule

STIG-ID|MADB-10-004500

Vuln-ID|V-253704

MADB-10-004600 - MariaDB must separate user functionality (including user interface services) from database management functionality.

CCI|CCI-001082

Rule-ID|SV-253705r841640_rule

STIG-ID|MADB-10-004600

Vuln-ID|V-253705

MADB-10-004700 - MariaDB must invalidate session identifiers upon user logout or other session termination. - max_statement_time

Detections

Analytics

DISA MariaDB Enterprise 10.x v1r2 DB

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous