Detections
Analytics
7.3 Ensure Passwords are Set for All MySQL Accounts
Information
Blank passwords allow a user to log in without using a password.Without a password, only knowing the username and the list of allowed hosts will allow someone to connect to the server and assume the identity of the user. This, in effect, bypasses authentication mechanisms.
Solution
For each row returned from the audit procedure, reset the password for the given user using the following statement (as an example):ALTER USER <user>@<host>
IDENTIFIED BY RANDOM PASSWORD
PASSWORD EXPIRE;
This resets the password temporarily to a RANDOM string and returns that temporary password as a result.
The user can then use this temporary password to log in and is forced to set the password to one of their choosing upon logging in.
Note: Replace <user>, <host> with appropriate values.
Additionally, install the password policy component and define your password policy.
INSTALL COMPONENT 'file://component_validate_password';
Edit the my.cnf file to define and enforce a password policy.
[mysqld]
validate_password.dictionary_file=/usr/share/dict/words
validate_password.length=10
validate_password.number_count=2
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CSCv7|4.4
Plugin: MySQLDB
Control ID: d201ee120227cf586382acbbfd96f220f14b1179afecb39f97e611612decbf74