MariaDB must generate audit records when privileges/permissions are added.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253750	MADB-10-009800	SV-253750r841775_rule		Medium

Description
Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. In MariaDB, adding permissions is done via the GRANT command, or, in the negative, the REVOKE command.

Description

Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. In MariaDB, adding permissions is done via the GRANT command, or, in the negative, the REVOKE command.

STIG	Date
MariaDB Enterprise 10.x Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-57202r841773_chk )
Verify the MariaDB Enterprise Audit plugin is loaded and actively logging: MariaDB> SHOW GLOBAL STATUS LIKE 'Server_audit_active'; If the MariaDB Enterprise Audit is not active, this is a finding. Check what filters are in place by running the following as an administrative user: MariaDB> SELECT * FROM mysql.server_audit_filters; Verify query_events includes DCL or ALL in corresponding audit filters. If not, this is a finding. In one terminal, tail the audit log file. For example: $ tail -F /var/lib/mysql/server_audit.log (default location) Open a new terminal and connect to the database. As the database administrator, create a user without special permissions: MariaDB> CREATE USER 'user_name_here'@'localhost' IDENTIFIED BY 'password_here'; As the database administrator, create a role by running the following SQL: MariaDB> CREATE ROLE 'role_name_here'; As the database administrator, GRANT role to testuser: MariaDB> GRANT 'role_name_here' TO 'user_name_here'@'localhost'; As the database administrator, add privileges to user_role for testdb, and add GRANT role to testuser: MariaDB> GRANT SELECT ON db_name_here TO 'user_name_here'@'localhost'; MariaDB> GRANT SELECT ON db_name_here TO 'role_name_here'; As the database administrator, modify privileges for testuser and user_role: MariaDB> GRANT DELETE ON db_name_here TO 'user_name_here'@'localhost'; MariaDB> GRANT DELETE ON db_name_here TO 'role_name_here'; If the audit records are not produced for successful attempts to modify privileges/permissions and roles in the first terminal, this is a finding.

Check Text ( C-57202r841773_chk )

Verify the MariaDB Enterprise Audit plugin is loaded and actively logging:

MariaDB> SHOW GLOBAL STATUS LIKE 'Server_audit_active';

If the MariaDB Enterprise Audit is not active, this is a finding.

Check what filters are in place by running the following as an administrative user:

MariaDB> SELECT * FROM mysql.server_audit_filters;

Verify query_events includes DCL or ALL in corresponding audit filters. If not, this is a finding.

In one terminal, tail the audit log file. For example:
$ tail -F /var/lib/mysql/server_audit.log (default location)

Open a new terminal and connect to the database.

As the database administrator, create a user without special permissions:
MariaDB> CREATE USER 'user_name_here'@'localhost' IDENTIFIED BY 'password_here';

As the database administrator, create a role by running the following SQL:
MariaDB> CREATE ROLE 'role_name_here';

As the database administrator, GRANT role to testuser:
MariaDB> GRANT 'role_name_here' TO 'user_name_here'@'localhost';

As the database administrator, add privileges to user_role for testdb, and add GRANT role to testuser:
MariaDB> GRANT SELECT ON db_name_here TO 'user_name_here'@'localhost';
MariaDB> GRANT SELECT ON db_name_here TO 'role_name_here';

As the database administrator, modify privileges for testuser and user_role:
MariaDB> GRANT DELETE ON db_name_here TO 'user_name_here'@'localhost';
MariaDB> GRANT DELETE ON db_name_here TO 'role_name_here';

If the audit records are not produced for successful attempts to modify privileges/permissions and roles in the first terminal, this is a finding.

Fix Text (F-57153r841774_fix)
The MariaDB Enterprise Audit plugin can be configured to audit these changes. Update necessary audit filters to include query_event ALL. Example: MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default'; MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule) VALUES ('default', JSON_COMPACT( '{ "connect_event": [ "CONNECT", "DISCONNECT" ], "query_event": [ "ALL" ] }' ));

Fix Text (F-57153r841774_fix)

The MariaDB Enterprise Audit plugin can be configured to audit these changes.

Update necessary audit filters to include query_event ALL. Example:

MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default';

MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule)
VALUES ('default',
JSON_COMPACT(
'{
"connect_event": [
"CONNECT",
"DISCONNECT"
],
"query_event": [
"ALL"
]
}'
));