MariaDB must generate audit records when unsuccessful logons or connection attempts occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253765	MADB-10-011300	SV-253765r841820_rule		Medium

Description
For completeness of forensic analysis, it is necessary to track failed attempts to log on to MariaDB. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.

STIG	Date
MariaDB Enterprise 10.x Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-57217r841818_chk )
Check what filters are in place by running the following as an administrative user: MariaDB> SELECT * FROM mysql.server_audit_filters; Verify connect_events include connect in audit filters. If not, this is a finding. Log in to and out of the MariaDB database server with both valid and invalid users. Verify the connect and disconnect are logged in the audit logfile or syslog depending on how it is configured. If connect/disconnect and invalid logins are not logged, this is a finding.

Check Text ( C-57217r841818_chk )

Check what filters are in place by running the following as an administrative user:

MariaDB> SELECT * FROM mysql.server_audit_filters;

Verify connect_events include connect in audit filters. If not, this is a finding.

Log in to and out of the MariaDB database server with both valid and invalid users. Verify the connect and disconnect are logged in the audit logfile or syslog depending on how it is configured.

If connect/disconnect and invalid logins are not logged, this is a finding.

Fix Text (F-57168r841819_fix)
Edit the necessary filters to include connect_events connect. Example: MariaDB> DELETE FROM mysql.server_audit_filters WHERE filtername = 'default'; MariaDB> INSERT INTO mysql.server_audit_filters (filtername, rule) VALUES ('default', JSON_COMPACT( '{ "connect_event": [ "CONNECT", "DISCONNECT" ] }' ));