Rule ID
SV-286180r1292229_rule
Version
V1R1
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Depending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. It is, therefore, imperative that access to audit tools be controlled and protected from unauthorized access. Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the access to audit tools. Audit tools include, but are not limited to, OS-provided audit tools, vendor-provided audit tools, and open-source audit tools needed to successfully view and manipulate audit information system activity and records. If an attacker were to gain access to audit tools, he could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity. Satisfies: SRG-APP-000121-DB-000202, SRG-APP-000122-DB-000203, SRG-APP-000123-DB-000204
The directory the audit logs are in the "my.cnf" (for CentOS, Red Hat, and similar distributions, this will be the "/etc/my.cnf") configuration file. By default, this file is owned by the OS DBA account. To check that the permissions of the "my.cnf" are owned by the DBA (root) with permissions of "0644", run: $ sudo su - root $ ls -la /etc/my.cnf $ ls -la /etc/my.cnf.d If "my.cnf" or any .cnf files located in the "my.cnf.d" directory are not owned by the DBA or do not have "0644" permissions, this is a finding. For stderr logging, verify the directory the audit logs have the database owner (mysql) as owner and group, with "0750" permissions. Check the "audit_log_dir" file permissions as follows: $ sudo su - root $ ls -la audit_log_dir /.. If permissions are not "0750", this is a finding. If the owner is not the database owner mysql, this is a finding. If the group is not the database owner mysql, this is a finding. For syslog logging, if MariaDB is configured to use syslog, verify the logs are owned by root and have "0600" permissions. If not, this is a finding.
Apply or modify access controls and permissions within MariaDB and at the operating system level for tools used to view or modify audit log data. These tools must be configurable only by authorized personnel. As the Linux DBA (root), ensure the MariaDB configuration file is owned by the operating system DBA and has appropriate permissions: sudo su - root chown root:root /etc/my.cnf chmod 644 /etc/my.cnf chown root:root /etc/my.cnf.d/*.cnf chmod 644 /etc/my.cnf.d/*.cnf For stderr logging, ensure the directory containing the audit logs has appropriate ownership and permissions: sudo su - root chown mysql:mysql audit_log_dir chmod 750 audit_log_dir For syslog logging, if MariaDB is configured to send logs to syslog, review the system security configuration to ensure that syslog log files are created with appropriate ownership and permissions in accordance with organizational security requirements.