← Back to MariaDB Enterprise Server Security Technical Implementation Guide

V-286238

CAT II (Medium)

MariaDB must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

Rule ID

SV-286238r1292008_rule

STIG

MariaDB Enterprise Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-004910

Discussion

A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.

Check Content

Verify MariaDB is configured to provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

If MariaDB is not configured to provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store, this is a finding.

Fix Text

Store TLS private keys and certificate files in a secure directory accessible only to the MariaDB server process.

Example secure directory:
/etc/my.cnf.d/certs/

Set restrictive ownership and permissions:

chown mysql:mysql /etc/my.cnf.d/certs/*
chmod 600 /etc/my.cnf.d/certs/*

Only the MariaDB service account should have read access to private keys.

Configure MariaDB to use the protected key files in the MariaDB configuration file ("/etc/my.cnf" or "/etc/mysql/my.cnf").

Example configuration:

[mariadb]
ssl-ca=/etc/my.cnf.d/certs/ca-cert.pem
ssl-cert=/etc/my.cnf.d/certs/server-cert.pem
ssl-key=/etc/my.cnf.d/certs/server-key.pem
require_secure_transport=ON

Restart MariaDB after configuration changes:

systemctl restart mariadb

If database encryption is used (for example InnoDB tablespace encryption), configure a secure key management plugin such as the MariaDB File Key Management plugin or an external key management service.

Example configuration for file-based key management:

[mariadb]
plugin_load_add=file_key_management
file_key_management_filename=/etc/mysql/encryption/keyfile
file_key_management_filekey=FILE:/etc/mysql/encryption/keyfile.key
file_key_management_encryption_algorithm=AES_CTR

Protect the key management files:

chown mysql:mysql /etc/mysql/encryption/*
chmod 600 /etc/mysql/encryption/*

If organizational policy requires hardware-protected key storage, configure MariaDB to integrate with an external key management system (for example a hardware security module [HSM] or enterprise key management service) supported by the environment.

Verify that cryptographic key files and key management files are protected using operating system access controls and accessible only to authorized administrators and the MariaDB service account.