← Back to MariaDB Enterprise Server Security Technical Implementation Guide

V-286234

CAT II (Medium)

MariaDB must, for password-based authentication, require immediate selection of a new password upon account recovery.

Rule ID

SV-286234r1291996_rule

STIG

MariaDB Enterprise Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-004063

Discussion

Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.

Check Content

Identify the account recovery procedure used for database accounts (administrative password reset). Verify that recovered accounts are marked as expired and require an immediate password change at next login.

Verify the user is configured to require a password change after recovery. As the DBA, run: 

SHOW CREATE USER 'username'@'host';

Confirm the account is configured with password expiration behavior consistent with the recovery process (e.g., "PASSWORD EXPIRE").

Verify enforcement using a functional test.

As a DBA, perform a simulated recovery by resetting the password and expiring it:

ALTER USER 'test_user'@'localhost' IDENTIFIED BY 'TempPass#123' PASSWORD EXPIRE;

Attempt to log in as "test_user" using the temporary password. Verify the session is required to change the password before normal access is granted (i.e., the account cannot continue normal operations without setting a new password).

If recovered accounts can authenticate and continue normal use without being forced to immediately change the password, this is a finding.

Fix Text

Configure MariaDB Enterprise to require users to change their password upon account recovery by enforcing password expiration.

Set password lifetime to enforce expiration:

Edit the mariadb-enterprise.cnf configuration file located in "/etc/my.cnf.d/".

Under [mariadb], add/edit the following: 

[mariadb]

default_password_lifetime = <organization-defined-value>;

Configure recovered or reset accounts to require immediate password change:

ALTER USER '<username>'@'<host>' PASSWORD EXPIRE;

Ensure administrative password reset procedures include setting the account to expired status:

ALTER USER '<username>'@'<host>' IDENTIFIED BY '<temporary_password>' PASSWORD EXPIRE;

Verify that accounts require password change upon next authentication:

SELECT User, Host, password_expired FROM mysql.user;

Ensure all password-based accounts subject to recovery processes are configured to require immediate password change upon first login following password reset.