Rule ID
SV-286219r1292247_rule
Version
V1R1
CCIs
Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.
To verify that system denies are logged when unprivileged users attempt to change database configuration, run the following commands using the DBA (shown here as root), and a newly created user shown here as "test_user": CREATE USER 'test_user'@'localhost' IDENTIFIED BY 'TEst_Password!2'; CREATE DATABASE myapp; CREATE TABLE myapp.mytable (a int, b char(10)); As the "test_user", alter the table: $ mariadb -u test_user -p Enter password: MariaDB> ALTER TABLE myapp.mytable ADD COLUMN (c int); Check the latest log to determine if the denial is logged. For example: $ tail -f /var/lib/mysql/server_audit.log 20260610 16:35:19,localhost.localdomain,test_user,localhost,9,0,CONNECT,,,0 20260610 16:35:19,localhost.localdomain,test_user,localhost,9,34,QUERY,,'select @@version_comment limit 1',0 20260610 16:35:39,localhost.localdomain,test_user,localhost,10,38,QUERY,,'ALTER TABLE myapp.mytable ADD COLUMN (c int)',1142 20260610 16:36:55,localhost.localdomain,test_user,localhost,9,0,DISCONNECT,,,0 If the denial is not produced, this is a finding. By default, MariaDB configuration files are owned by the OS administrator user (root) and cannot be edited by nonprivileged users: $ ls -la /etc | grep my.cnf -rw-r--r--. 1 root root 301 Mar 25 12:45 my.cnf If "my.cnf" is not owned by the OS administrator (root) and does not have read and write permissions for the owner, this is a finding.
Verify that audit logging is enabled and properly configured using the MariaDB Audit Plugin. The MariaDB Audit Plugin provides several configuration options and system variables that control audit logging behavior. After installation, review the current configuration by displaying the relevant system variables. As the DBA, run: SHOW GLOBAL VARIABLES LIKE '%server_audit%'; Audit events recorded by the MariaDB Audit Plugin are grouped into several event categories, including connect, query, and table events. Configure MariaDB Enterprise Server 11.8 to generate audit records containing the required audit event information. Ensure the MariaDB Enterprise Audit Plugin is installed and enabled. Edit the "mariadb-enterprise.cnf" configuration file located in "/etc/my.cnf.d/". [mariadb] server_audit_events=CONNECT,QUERY By default, audit logging is disabled. To enable audit logging, set the "server_audit_logging" variable to "ON". Under [mariadb], add/edit the following: [mariadb] server_audit_logging=ON If the query cache is enabled and a query result is returned from the cache, "TABLE" events may not appear in the audit log because the server does not access the underlying tables. In environments where accurate auditing of table access is required, disabling query caching may be appropriate. If query-related event types are enabled, such as "QUERY", "QUERY_DDL", "QUERY_DML", "QUERY_DML_NO_SELECT", or "QUERY_DCL", the executed SQL statements will be recorded in the audit log exactly as they are executed. Because queries are recorded in plain text, audit log files must be protected with appropriate file system permissions. Access to audit log files should be restricted to authorized administrators and stored in a protected directory. Alternatively, the "TABLE" event type may be used instead of query-related event types to reduce exposure of sensitive query content. Queries that fail to execute, including queries with syntax errors or insufficient privileges, will also be recorded in the audit log. These events can be identified using the error codes recorded in the audit log entry. Ensure that the "server_audit_events" configuration includes "QUERY", "TABLE", and any additional events required by the organization. server_audit_events=QUERY,TABLE