Detections
Analytics

1.101 MADB-10-011600

Information

MariaDB must generate audit records showing starting and ending time for user access to the database(s).

GROUP ID: V-253768
RULE ID: SV-253768r961830

For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to MariaDB lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs.

Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the necessary filters to include connect_events connect. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
 VALUES ('default',
 JSON_COMPACT(
 '{
 "connect_event": [
 "CONNECT",
 "DISCONNECT"
 ]
 }'
 ));

See Also

https://workbench.cisecurity.org/benchmarks/26720

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CCI|CCI-000172, Rule-ID|SV-253768r961830_rule, STIG-ID|MADB-10-011600, Vuln-ID|V-253768

Plugin: MySQLDB

Control ID: b7649e781dac490607bd10e93ccb7b342a35170371fdd750482e3e74f5fe1cc5