← Back to MariaDB Enterprise Server Security Technical Implementation Guide

V-286232

CAT II (Medium)

MariaDB must disable accounts when the accounts are no longer associated to a user.

Rule ID

SV-286232r1292176_rule

STIG

MariaDB Enterprise Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-003628

Discussion

MariaDB must be able to disabling expired, inactive, or otherwise anomalous accounts supports the concepts of least privilege and least functionality, which reduce the attack surface of the system.

Check Content

Log in to MariaDB Enterprise Server as the database administrator.

List all database accounts:

SELECT User, Host
FROM mysql.global_priv;

Review the returned accounts and compare them with the organization's authorized user records.

Verify that each database account is associated with a currently-authorized user or approved service account.

If a database account exists for a user who is no longer authorized to access the system and the account has not been disabled or removed in accordance with organizational account management procedures, this is a finding.

Fix Text

Remove the account if it is no longer required:

DROP USER 'user'@'host';

If organizational policy requires the account to be retained, disable the account.

Verify that only authorized user and service accounts remain:

SELECT User, Host
FROM mysql.global_priv;