← Back to MariaDB Enterprise Server Security Technical Implementation Guide

V-286221

CAT II (Medium)

MariaDB must prohibit the use of cached authenticators after an organization-defined time period.

Rule ID

SV-286221r1292210_rule

STIG

MariaDB Enterprise Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002007

Discussion

If cached authentication information is out of date, the validity of the authentication information may be questionable.

Check Content

Each connection to the MariaDB database requires the authentication of the user. The authentication remains in place for the connection until the connection is closed or the connection times out due to inactivity. The system parameter "idle_transaction_timeout" specifies in seconds when a connection will be terminated due to inactivity. After a connection is terminated, and new request to the database must be preceded by an authentication which is not cached within the database.

Verify that the "idle_transaction_timeout" is set to a value other than "0" or is set to the value needed by the administrator. 

The value of "idle_transaction_timeout" can be validated by issuing "SHOW VARIABLES". 

SHOW GLOBAL VARIABLES LIKE 'idle_transaction_timeout ';

If variable is set to a value other than "0" or is set to the value needed, this is a finding.

Fix Text

Verify that the "idle_transaction_timeout" is set to a value other than "0" or is set to the value needed by the administrator. 

To modify these values, locate the MariaDB Enterprise Server configuration file to change. For Centos, RedHat, and similar distributions, this will be located in "/etc/my.cnf.d/".

In the [mariadb] section, add the lines:

idle_transaction_timeout = value