← Back to MariaDB Enterprise 10.x Security Technical Implementation Guide

V-253772

CAT II (Medium)

MariaDB must generate audit records for all direct access to the database(s).

Rule ID

SV-253772r961839_rule

STIG

MariaDB Enterprise 10.x Security Technical Implementation Guide

Version

V2R5

CCIs

CCI-000172

Discussion

In this context, direct access is any query, command, or call to MariaDB that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and nonstandard sources.

Check Content

Check what filters are in place by running the following as an administrative user: 

MariaDB> SELECT * FROM mysql.server_audit_filters;

Verify connect_events include connect in audit filters. If not, this is a finding.

Fix Text

Edit the necessary filters to include  connect_events connect. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
   VALUES ('default',
      JSON_COMPACT(
         '{
            "connect_event":"CONNECT"
         }'
      ));