V-286191

Discussion

OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and Authorizing Official (AO) approved. The DoW standard for authentication is DoW-approved PKI certificates. Authentication based on user ID and password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. In such cases, the DoW standards for password complexity and lifetime must be implemented. MariaDB that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code. Satisfies: SRG-APP-000164-DB-000401, SRG-APP-000860-DB-000250

Check Content

Check the "simple_password_check" plugin variables to ensure they match the password requirements. 

SHOW VARIABLES LIKE 'simple_password_check%';

Example output:
+-----------------------------------------+-------+
| Variable_name                           | Value |
+-----------------------------------------+-------+
| simple_password_check_digits            | 1     |
| simple_password_check_letters_same_case | 1     |
| simple_password_check_minimal_length    | 8     |
| simple_password_check_other_characters  | 1     |
+-----------------------------------------+-------+

Determine whether the following rules are enforced. If they do not meet the following password requirements, this is a finding. 

A minimum of 15 characters, including at least one of each of the following character sets:
- Uppercase.
- Lowercase.
- Numeric.
- Special characters (e.g., ~ ! @ # $ % ^ & * ( ) _ + = - ' [ ] / ? > <).