Rule ID
SV-286231r1291987_rule
Version
V1R1
CCIs
MariaDB needs to allow for disabling expired, inactive, or otherwise anomalous accounts supports the concept of least privilege and least functionality, which reduce the attack surface of the system.
Identify accounts configured with password expiration. Run the following SQL as a DBA: SELECT user, host, password_expired FROM mysql.user; Accounts with "password_expired" equal to "Y" have expired passwords. If expired accounts are present and are still able to authenticate without resetting their password, this is a finding. Verify password expiration settings for users by running: SHOW CREATE USER 'username'@'host'; Review the output for password expiration configuration such as: PASSWORD EXPIRE PASSWORD EXPIRE INTERVAL N DAY If user accounts are not configured according to the organization's password expiration policy, this is a finding. Verify that expired accounts cannot authenticate without changing their password. Attempt to connect using an account with an expired password. MariaDB should require the password to be reset before access is granted. If expired accounts are allowed to authenticate and execute queries without resetting the password, this is a finding. Verify global password expiration policy if required by the organization by running: SHOW VARIABLES LIKE 'default_password_lifetime'; If the system does not enforce the organization's password expiration policy where required, this is a finding.
Configure password expiration to require periodic password changes: ALTER USER 'someusername'@'localhost' PASSWORD EXPIRE INTERVAL 60 DAY; To view information about a user's password expiration settings, run: SHOW CREATE USER 'foo4'@'test'; Account-Specific Policy: Password expiration can be configured for individual accounts using "ALTER USER" or "CREATE USER" with the "PASSWORD EXPIRE" option. If a user's password expires and it is not changed, server behavior depends on the "disconnect_on_expired_password" system variable and whether the client supports expired passwords. In this case, the account is placed in a restricted mode allowing only password reset operations. User accounts can also be manually disabled using the account lock command: ALTER USER 'inactive_user'@'localhost' ACCOUNT LOCK; MariaDB also provides an audit plugin that can log user activity such as logins, executed queries, and database modifications. This can assist administrators in identifying inactive accounts. If an account is determined to be inactive, lock the account: ALTER USER 'inactive_user'@'localhost' ACCOUNT LOCK;