Rule ID
SV-286225r1291969_rule
Version
V1R1
Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting or receiving data MariaDB, associated applications, and infrastructure must leverage transmission protection mechanisms. Satisfies: SRG-APP-000441-DB-000378, SRG-APP-000442-DB-000379
If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, this is not a finding. As the DBA (shown here as root), verify the following settings: SHOW GLOBAL VARIABLES LIKE 'ssl_ca'; SHOW GLOBAL VARIABLES LIKE 'ssl_cert'; SHOW GLOBAL VARIABLES LIKE 'ssl_key'; If SSL is not enabled, this is a finding. If MariaDB does not employ protective measures against unauthorized disclosure and modification during preparation for transmission, this is a finding.
Implement protective measures against unauthorized disclosure and modification of information during transmission or reception. Configure MariaDB to use SSL/TLS to protect database connections. 1. Install the MariaDB server and client packages. apt-get update -y apt-get install mariadb-server mariadb-client -y 2. Create a directory to store SSL certificates and keys. mkdir /etc/mysql/certs cd /etc/mysql/certs 3. Generate the Certificate Authority (CA) private key and certificate. openssl genrsa 2048 > ca-key.pem openssl req -new -x509 -nodes -days 3650 -key ca-key.pem -out ca-cert.pem 4. Generate the server private key and certificate. openssl req -newkey rsa:2048 -nodes -keyout server-key.pem -out server-req.pem openssl rsa -in server-key.pem -out server-key.pem openssl x509 -req -in server-req.pem -days 365 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem 5. Configure MariaDB to use SSL by editing the MariaDB configuration file (for example, "/etc/mysql/mariadb.conf.d/50-server.cnf") and adding the following lines in the [mariadb] section: ssl-ca=/etc/mysql/certs/ca-cert.pem ssl-cert=/etc/mysql/certs/server-cert.pem ssl-key=/etc/mysql/certs/server-key.pem 6. Restart the MariaDB service to apply the configuration. systemctl restart mariadb 7. Verify that SSL is enabled. SHOW VARIABLES LIKE '%ssl%'; 8. Configure users to require SSL connections. GRANT ALL PRIVILEGES ON *.* TO 'client'@'client_ip_address' IDENTIFIED BY 'password' REQUIRE SSL; FLUSH PRIVILEGES; 9. Verify the SSL connection. mariadb -u client -h server_ip_address -p status