Rule ID
SV-286192r1292187_rule
Version
V1R1
CCIs
The DoW standard for authentication is DoW-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires Authorizing Official (AO) approval. In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. DBMS passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.
Verify SSL is in use. Run the following database command: MariaDB> STATUS; Verify the line which starts with "SSL:" is as expected. It should return "cert is OK". If the line returned is "Not in use", this is a finding. Use results of next query to show SSL on for all users: SELECT user, host, ssl_type from mysql.user; If "ssl_type" is blank, this is a finding. Verify Transport Layer Security (TLS) configuration: SHOW VARIABLES LIKE 'tls_version'; The "tls_version" variable should show TLSv1.2,TLSv1.3. If not, this is a finding. SHOW VARIABLES LIKE 'have_ssl'; The "have_ssl" variable should return "YES". If not, this is a finding.
Configure TLS certificates and restrict the TLS protocol versions. Edit the "mariadb-enterprise.cnf" configuration file located in "/etc/my.cnf.d/". Under [mariadb], add/edit the following: [mariadb] ssl-ca=/etc/my.cnf.d/certs/ca-cert.pem ssl-cert=/etc/my.cnf.d/certs/server-cert.pem ssl-key=/etc/my.cnf.d/certs/server-key.pem tls_version=TLSv1.2,TLSv1.3 This configuration enables TLS encryption and restricts connections to TLS 1.2 and TLS 1.3. Restart the MariaDB server for the configuration changes to take effect: systemctl restart mariadb Enforce encrypted client connections for database users where required by policy: ALTER USER 'username'@'host' REQUIRE SSL; or, if client certificates are required: ALTER USER 'username'@'host' REQUIRE X509;