Detections
Analytics

6.5 Ensure Audit Filters Capture Connection Attempts

Information

The functions audit_log_filter_set_filter() and audit_log_filter_set_user() are used to define rules for auditing. With this feature, you can easily audit successful and/or failed connection events and write to the audit log file.

The audit_log_filter_set_filter function defines auditing filters. The users for which filter(s) apply are defined by audit_log_filter_set_user . One or more filters can be created to log connections success and/or failure.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate this configuration setting, execute one of the following SQL statements:

Log All connections - Successful and Failed:

SET @f = '{ "filter": { "class": { "name": "connection" } } }';
SELECT audit_log_filter_set_filter('log__all_conn_events', @f);
SELECT audit_log_filter_set_user('%', 'log_all_conn_events');

Or

Log Only Failed Connections:

SET @f='
{
 "filter": {
 "log": false,
 "class": {
 "name": "connection",
 "event": [
 { "name": "connect", "log" : { "not": { "field": { "name": "status", "value": 0 } } } },
 { "name": "disconnect", "log": false }
 ]
 }
 }
 }';
select @f;
SELECT audit_log_filter_set_filter('log_conn_events', @f);
SELECT audit_log_filter_set_user('%', 'log_conn_events');

Impact:

If the audit rule and application of the rule to targeted or all users is not properly configured, it will not log failed connections, successful connections or any other connection-related events.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: MySQLDB

Control ID: 55cf7ebcff5358aa625b86a8048aea0651907f25b9d294eddfe5d2a5bb8f7cff