Detections
Analytics

1.105 MADB-10-012000

Information

MariaDB must generate audit records for all direct access to the database(s).

GROUP ID: V-253772
RULE ID: SV-253772r961839

In this context, direct access is any query, command, or call to MariaDB that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and nonstandard sources.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the necessary filters to include connect_events connect. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
 VALUES ('default',
 JSON_COMPACT(
 '{
 "connect_event":"CONNECT"
 }'
 ));

See Also

https://workbench.cisecurity.org/benchmarks/26720

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CCI|CCI-000172, Rule-ID|SV-253772r961839_rule, STIG-ID|MADB-10-012000, Vuln-ID|V-253772

Plugin: MySQLDB

Control ID: ca774299e6d2abf7daf113f184c54d181e82baf4ef18f11544117b0acc140444