STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 2 hours ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to STIGs

MariaDB Enterprise Server Security Technical Implementation Guide

Version

V1R1

Release Date

Oct 14, 2026

SCAP Benchmark ID

MariaDB_Enterprise_Server

Total Checks

68

Tags

other
CAT I: 12CAT II: 56CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (68)

V-286171MEDIUMMariaDB must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.V-286172HIGHMariaDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.V-286173HIGHMariaDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.V-286174MEDIUMMariaDB must protect against a user falsely repudiating having performed organization-defined actions.V-286175MEDIUMMariaDB must provide audit record generation capability for DoW-defined auditable events within all DBMS/database components.V-286176MEDIUMMariaDB must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.V-286177MEDIUMMariaDB must produce audit records containing sufficient information including time stamps, sources (origins), identity, and type to establish events that have occurred.V-286178MEDIUMMariaDB must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.V-286179MEDIUMThe audit information produced by MariaDB must be protected from unauthorized read access.V-286180MEDIUMMariaDB must protect its audit features from unauthorized access.V-286181MEDIUMMariaDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the DBMS.V-286182HIGHThe MariaDB software installation account must be restricted to authorized users.V-286183MEDIUMDatabase software, including MariaDB configuration files, must be stored in dedicated directories, separate from the host OS and other applications.V-286184MEDIUMDatabase objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MariaDB, etc.) must be owned by database/MariaDB principals authorized for ownership.V-286185MEDIUMThe role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the MariaDB, etc.) must be restricted to authorized users.V-286186MEDIUMDefault demonstration and sample databases, database objects, and applications must be removed.V-286187MEDIUMUnused database components, DBMS software, and database objects must be removed.V-286188MEDIUMAccess to external executables must be disabled or restricted.V-286189MEDIUMMariaDB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.V-286190MEDIUMMariaDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-286191HIGHIf DBMS authentication, using passwords, is employed, MariaDB must enforce the DoW standards for password complexity and lifetime.V-286192HIGHIf passwords are used for authentication, MariaDB must transmit only encrypted representations of passwords.V-286193MEDIUMMariaDB, when using PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.V-286194HIGHMariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.V-286195MEDIUMMariaDB must map a PKI ID to an associated user account.V-286196HIGHMariaDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.V-286197HIGHMariaDB must use NIST FIPS 140-3-validated cryptographic modules for cryptographic operations.V-286198MEDIUMThe MariaDB must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).V-286199MEDIUMMariaDB must separate user functionality (including user interface services) from database management functionality.V-286200MEDIUMMariaDB must invalidate session identifiers upon user logout or other session termination.V-286201MEDIUMMariaDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at session ID values.V-286202MEDIUMMariaDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.V-286203HIGHMariaDB must protect the confidentiality and integrity of all information at rest.V-286204MEDIUMDatabase contents must be protected from unauthorized and unintended information transfer by enforcement of a data transfer policy.V-286205MEDIUMAccess to database files must be limited to relevant processes and to authorized, administrative users.V-286206MEDIUMMariaDB must check the validity of all data inputs except those specifically identified by the organization.V-286207MEDIUMMariaDB and associated applications must reserve the use of dynamic code execution for situations that require it.V-286208MEDIUMMariaDB must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA), and database administrator (DBA).V-286209MEDIUMMariaDB must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.V-286211MEDIUMMariaDB must associate organization-defined types of security labels having organization-defined security label values with information in process, transit, or storage.V-286212MEDIUMMariaDB must enforce discretionary access control (DAC) policies, as defined by the data owner, over defined subjects and objects.V-286213MEDIUMMariaDB must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.V-286214MEDIUMExecution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.V-286215MEDIUMMariaDB must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.V-286216MEDIUMMariaDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.V-286217MEDIUMMariaDB must record time stamps, in audit records and application data, that can be mapped to Coordinated Universal Time (UTC).V-286218MEDIUMMariaDB must enforce access restrictions associated with changes to the configuration of MariaDB or database(s).V-286219MEDIUMMariaDB must produce audit records of its enforcement of access restrictions associated with changes to the configuration of the DBMS or database(s).V-286220MEDIUMMariaDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.V-286221MEDIUMMariaDB must prohibit the use of cached authenticators after an organization-defined time period.V-286222HIGHMariaDB must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements.V-286223MEDIUMMariaDB must only accept end entity certificates issued by DoW Public Key Infrastructure (PKI) or DoW-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.V-286224HIGHMariaDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, Personally Identifiable Information [PII] and classified information) on organization-defined information system components.V-286225MEDIUMMariaDB must maintain the confidentiality and integrity of information during preparation for transmission or reception.V-286226MEDIUMWhen invalid inputs are received, MariaDB must behave in a predictable and documented manner that reflects organizational and system objectives.V-286227MEDIUMWhen updates are applied to the MariaDB software, any software components that have been replaced or made unnecessary must be removed.V-286228MEDIUMSecurity-relevant software updates to MariaDB must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).V-286229HIGHMariaDB products must be a version supported by the vendor. Only MariaDB Enterprise is supported.V-286230MEDIUMMariaDB must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for standalone systems.V-286231MEDIUMMariaDB must disable accounts when accounts have expired.V-286232MEDIUMMariaDB must disable accounts when the accounts are no longer associated to a user.V-286233MEDIUMMariaDB must, for password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.V-286234MEDIUMMariaDB must, for password-based authentication, require immediate selection of a new password upon account recovery.V-286235MEDIUMMariaDB must, for public key-based authentication, implement a local cache of revocation data to support path discovery and validation.V-286236MEDIUMMariaDB must protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths.V-286237MEDIUMMariaDB must include only approved trust anchors in trust stores or certificate stores managed by the organization.V-286238MEDIUMMariaDB must provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.V-286239MEDIUMMariaDB must synchronize system clocks within and between systems or system components.