← Back to MariaDB Enterprise Server Security Technical Implementation Guide

V-286196

CAT I (High)

MariaDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

Rule ID

SV-286196r1292188_rule

STIG

MariaDB Enterprise Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000206

Discussion

The DoW standard for authentication is DoW-approved PKI certificates. Normally with PKI authentication, the interaction with the user for authentication will be handled by a software component separate from the DBMS, such as ActivIdentity ActivClient. However, in cases where the DBMS controls the interaction, this requirement applies. To prevent the compromise of authentication information such as passwords and PINs during the authentication process, the feedback from the system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. Obfuscation of user-provided authentication secrets when typed into the system is a method used in addressing this risk. Displaying asterisks when a user types in a password or a smart card PIN is an example of obscuring feedback of authentication secrets. This calls for review of applications, which will require collaboration with the application developers. It is recognized that in many cases, the DBA is organizationally separate from the application developers, and may have limited, if any, access to source code. At a minimum, the DBA must attempt to obtain assurances from the development organization that this issue has been addressed and must document what has been discovered.

Check Content

Verify best practices are documented and users trained to use the password command line interface flags appropriately. 

For example, the command line option "--password" or "-p" prompts for a password to be entered and obscures feedback on the typed in password. 

Ensure users are trained to use alternatives to command line password parameters. If they are not, this is a finding.

Fix Text

Enable external users' authentication by using the PAM plugin.

Integrate MariaDB security with an organization-level authentication/access mechanism providing account management for all users, groups, roles, and any other principals.

As the DBA (root), install and configure the PAM authentication module:

INSTALL SONAME  auth_pam 

PAM supports many authentication methods including LDAP, Active Directory, and Kerberos. Each method must be configured properly in "/etc/pam.d" and "/etc/pam.conf". 

When connecting to the database, the username and password are sent to the server via the command line interface or other connector interface. Using the command line interface, passing the "-p" or "--password" flags but not including the password in the command will prompt for the password and not display it on the screen as typed. 

Example: 
mariadb -u username -proved 

Either transfer this to management by an external mechanism or document the need for it and obtain approval.

ALTER USER username@host IDENTIFIED VIA pam USING  method 

If global variables "have_openssl" and "version_ssl_library" are not set correctly, then download a new MariaDB binary from mariadb.com and reinstall.