Detections
Analytics

1.97 MADB-10-011200

Information

MariaDB must generate audit records when successful logons or connections occur.

GROUP ID: V-253764
RULE ID: SV-253764r961824

For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to the DBMS.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the necessary filters to include connect_events connect. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
 VALUES ('default',
 JSON_COMPACT(
 '{
 "connect_event": [
 "CONNECT",
 "DISCONNECT"
 ]
 }'
 ));

See Also

https://workbench.cisecurity.org/benchmarks/26720

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CCI|CCI-000172, Rule-ID|SV-253764r961824_rule, STIG-ID|MADB-10-011200, Vuln-ID|V-253764

Plugin: MySQLDB

Control ID: 1afa6a9f59dddbee11404d3c17ec8274cc624222b55fd82d8a1485c59a151f79