2.17 Ensure Only Approved Ciphers are Used

Information

MySQL supports multiple encryption ciphers. Ciphers can vary in strength, speed and overhead.

Rationale:

Requiring clients attempting to connect to MySQL to use strong ciphers protects data in transit.

Impact:

Connections attempting to use an unsupported cipher will fail.

Solution

Set ssl_cipher and tls_ciphersuites in the mysql.conf to an approved cipher suite:

tls_ciphersuites='TLS_AES_256_GCM_SHA384'
ssl_cipher='ECDHE-ECDSA-AES128-GCM-SHA256'

Or

Execute the following commands:

set persist ssl_cipher='ECDHE-ECDSA-AES128-GCM-SHA256';
set persist tls_ciphersuites='TLS_AES_256_GCM_SHA384';

See Also

https://workbench.cisecurity.org/benchmarks/10139

Item Details

Category: SYSTEM AND SERVICES ACQUISITION

References: 800-53|SA-15, CSCv7|18.5

Plugin: MySQLDB

Control ID: a04178556ce5ce00225f46dc8413bb6b6c5a16894f042a2ac2e42459ac6fa292