Detections
Analytics

1.98 MADB-10-011300

Information

MariaDB must generate audit records when unsuccessful logons or connection attempts occur.

GROUP ID: V-253765
RULE ID: SV-253765r961824

For completeness of forensic analysis, it is necessary to track failed attempts to log on to MariaDB. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the necessary filters to include connect_events connect. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
 VALUES ('default',
 JSON_COMPACT(
 '{
 "connect_event": [
 "CONNECT",
 "DISCONNECT"
 ]
 }'
 ));

See Also

https://workbench.cisecurity.org/benchmarks/26720

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CCI|CCI-000172, Rule-ID|SV-253765r961824_rule, STIG-ID|MADB-10-011300, Vuln-ID|V-253765

Plugin: MySQLDB

Control ID: 0ec66b8bfa340f6a1f7d7fdd502c00e58a98a0972d674d4db03ad5dd1509adb1