MADB-10-011300 - MariaDB must generate audit records when unsuccessful logons or connection attempts occur.

Information

For completeness of forensic analysis, it is necessary to track failed attempts to log on to MariaDB. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the necessary filters to include connect_events connect. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('default',
JSON_COMPACT(
'{
"connect_event": [
"CONNECT",
"DISCONNECT"
]
}'
));

Item Details

Audit Name: DISA MariaDB Enterprise 10.x STIG v2r5 MySQLDB

Category: AUDIT AND ACCOUNTABILITY

Plugin: MySQLDB

Control ID: 4ae2310a734846e1fe8a990529366f5d3a9a1bc6673f6ed7562b8edd06bf1eae

Detections

Analytics

MADB-10-011300 - MariaDB must generate audit records when unsuccessful logons or connection attempts occur.

Information

Solution

See Also

Item Details