MADB-10-000100 - MariaDB must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

CAT|III

CCI|CCI-000054

Rule-ID|SV-253666r960735_rule

STIG-ID|MADB-10-000100

Vuln-ID|V-253666

MADB-10-000200 - MariaDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-253667r1043176_rule

STIG-ID|MADB-10-000200

Vuln-ID|V-253667

MADB-10-000300 - MariaDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

CCI|CCI-000213

Rule-ID|SV-253668r960792_rule

STIG-ID|MADB-10-000300

Vuln-ID|V-253668

MADB-10-000400 - MariaDB must protect against a user falsely repudiating having performed organization-defined actions.

CAT|II

CCI|CCI-000166

Rule-ID|SV-253669r960864_rule

STIG-ID|MADB-10-000400

Vuln-ID|V-253669

MADB-10-000500 - MariaDB must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.

CCI|CCI-000169

Rule-ID|SV-253670r960879_rule

STIG-ID|MADB-10-000500

Vuln-ID|V-253670

MADB-10-000600 - MariaDB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

CCI|CCI-000171

Rule-ID|SV-253671r960882_rule

STIG-ID|MADB-10-000600

Vuln-ID|V-253671

MADB-10-000700 - MariaDB must be able to generate audit records when privileges/permissions are retrieved.

CCI|CCI-000172

Rule-ID|SV-253672r960885_rule

STIG-ID|MADB-10-000700

Vuln-ID|V-253672

MADB-10-000800 - MariaDB must be able to generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.

Rule-ID|SV-253673r960885_rule

STIG-ID|MADB-10-000800

Vuln-ID|V-253673

MADB-10-000900 - MariaDB must initiate session auditing upon startup.

CCI|CCI-001464

Rule-ID|SV-253674r960888_rule

STIG-ID|MADB-10-000900

Vuln-ID|V-253674

MADB-10-001000 - MariaDB must produce audit records containing sufficient information to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-253675r960891_rule

STIG-ID|MADB-10-001000

Vuln-ID|V-253675

MADB-10-001600 - MariaDB must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

CCI|CCI-000135

Rule-ID|SV-253676r960909_rule

STIG-ID|MADB-10-001600

Vuln-ID|V-253676

MADB-10-001700 - MariaDB must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

CCI|CCI-000140

Rule-ID|SV-253677r1043188_rule

STIG-ID|MADB-10-001700

Vuln-ID|V-253677

MADB-10-001800 - MariaDB must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

Rule-ID|SV-253678r1043188_rule

STIG-ID|MADB-10-001800

Vuln-ID|V-253678

MADB-10-002000 - The audit information produced by MariaDB must be protected from unauthorized read access.

CCI|CCI-000162

Rule-ID|SV-253679r960930_rule

STIG-ID|MADB-10-002000

Vuln-ID|V-253679

MADB-10-002100 - The audit information produced by MariaDB must be protected from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-253680r960933_rule

STIG-ID|MADB-10-002100

Vuln-ID|V-253680

MADB-10-002200 - The audit information produced by MariaDB must be protected from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-253681r960936_rule

STIG-ID|MADB-10-002200

Vuln-ID|V-253681

MADB-10-002300 - MariaDB must protect its audit features from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-253682r960939_rule

STIG-ID|MADB-10-002300

Vuln-ID|V-253682

MADB-10-002400 - MariaDB must protect its audit configuration from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-253683r960942_rule

STIG-ID|MADB-10-002400

Vuln-ID|V-253683

MADB-10-002500 - MariaDB must protect its audit features from unauthorized removal.

CCI|CCI-001495

Rule-ID|SV-253684r960945_rule

STIG-ID|MADB-10-002500

Vuln-ID|V-253684

MADB-10-002600 - MariaDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the DBMS.

CCI|CCI-001499

Rule-ID|SV-253685r960960_rule

STIG-ID|MADB-10-002600

Vuln-ID|V-253685

MADB-10-002700 - The MariaDB software installation account must be restricted to authorized users.

Rule-ID|SV-253686r960960_rule

STIG-ID|MADB-10-002700

Vuln-ID|V-253686

MADB-10-002800 - Database software, including MariaDB configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

Rule-ID|SV-253687r960960_rule

STIG-ID|MADB-10-002800

Vuln-ID|V-253687

MADB-10-002900 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MariaDB, etc.) must be owned by database/MariaDB principals authorized for ownership.

Rule-ID|SV-253688r960960_rule

STIG-ID|MADB-10-002900

Vuln-ID|V-253688

MADB-10-003000 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the MariaDB, etc.) must be restricted to authorized users.

Rule-ID|SV-253689r960960_rule

STIG-ID|MADB-10-003000

Vuln-ID|V-253689

MADB-10-003100 - Default demonstration and sample databases, database objects, and applications must be removed.

CCI|CCI-000381

Rule-ID|SV-253690r960963_rule

STIG-ID|MADB-10-003100

Vuln-ID|V-253690

MADB-10-003200 - Unused database components, DBMS software, and database objects must be removed.

Rule-ID|SV-253691r960963_rule

STIG-ID|MADB-10-003200

Vuln-ID|V-253691

MADB-10-003400 - Access to external executables must be disabled or restricted.

Rule-ID|SV-253692r960963_rule

STIG-ID|MADB-10-003400

Vuln-ID|V-253692

MADB-10-003500 - MariaDB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-253693r1043177_rule

STIG-ID|MADB-10-003500

Vuln-ID|V-253693

MADB-10-003600 - MariaDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-253694r1051115_rule

STIG-ID|MADB-10-003600

Vuln-ID|V-253694

MADB-10-003700 - If MariaDB authentication, using passwords, is employed, then MariaDB must enforce the DOD standards for password complexity.

CCI|CCI-000192

CCI|CCI-004066

Rule-ID|SV-253695r1018598_rule

STIG-ID|MADB-10-003700

Vuln-ID|V-253695

MADB-10-003750 - If MariaDB authentication using passwords is employed, MariaDB must enforce the DOD standards for password lifetime.

Rule-ID|SV-253696r1018599_rule

STIG-ID|MADB-10-003750

Vuln-ID|V-253696

MADB-10-003800 - If passwords are used for authentication, MariaDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

CCI|CCI-004062

Rule-ID|SV-253697r1018600_rule

STIG-ID|MADB-10-003800

Vuln-ID|V-253697

MADB-10-003900 - If passwords are used for authentication, MariaDB must transmit only encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-253698r961029_rule

STIG-ID|MADB-10-003900

Vuln-ID|V-253698

MADB-10-004000 - MariaDB, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-253699r961038_rule

STIG-ID|MADB-10-004000

Vuln-ID|V-253699

MADB-10-004100 - MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.

CCI|CCI-000186

Rule-ID|SV-253700r961041_rule

STIG-ID|MADB-10-004100

Vuln-ID|V-253700

MADB-10-004200 - MariaDB must map PKI ID to an associated user account.

CCI|CCI-000187

Rule-ID|SV-253701r961044_rule

STIG-ID|MADB-10-004200

Vuln-ID|V-253701

MADB-10-004300 - MariaDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

CCI|CCI-000206

Rule-ID|SV-253702r961047_rule

STIG-ID|MADB-10-004300

Vuln-ID|V-253702

MADB-10-004400 - MariaDB must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.

CCI|CCI-000803

Rule-ID|SV-253703r961050_rule

STIG-ID|MADB-10-004400

Vuln-ID|V-253703

MADB-10-004500 - The MariaDB must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

CCI|CCI-000804

Rule-ID|SV-253704r961053_rule

STIG-ID|MADB-10-004500

Vuln-ID|V-253704

MADB-10-004600 - MariaDB must separate user functionality (including user interface services) from database management functionality.

CCI|CCI-001082

Rule-ID|SV-253705r1051299_rule

STIG-ID|MADB-10-004600

Vuln-ID|V-253705

MADB-10-004700 - MariaDB must invalidate session identifiers upon user logout or other session termination.

Detections

Analytics

DISA MariaDB Enterprise 10.x v2r3 DB

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous