MADB-10-011600 - MariaDB must generate audit records showing starting and ending time for user access to the database(s).

Information

For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to MariaDB lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs.

Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Edit the necessary filters to include connect_events connect. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('default',
JSON_COMPACT(
'{
"connect_event": [
"CONNECT",
"DISCONNECT"
]
}'
));

Item Details

Audit Name: DISA MariaDB Enterprise 10.x STIG v2r5 MySQLDB

Category: AUDIT AND ACCOUNTABILITY

Plugin: MySQLDB

Control ID: 1d92c842c1f56ff25c7c08b1402872f41bdab6450788cfe9c17cc42408696672

Detections

Analytics

MADB-10-011600 - MariaDB must generate audit records showing starting and ending time for user access to the database(s).

Information

Solution

See Also

Item Details