MADB-10-000100 - MariaDB must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

CAT|III

CCI|CCI-000054

Rule-ID|SV-253666r879511_rule

STIG-ID|MADB-10-000100

Vuln-ID|V-253666

MADB-10-000200 - MariaDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-253667r879522_rule

STIG-ID|MADB-10-000200

Vuln-ID|V-253667

MADB-10-000300 - MariaDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

CCI|CCI-000213

Rule-ID|SV-253668r879530_rule

STIG-ID|MADB-10-000300

Vuln-ID|V-253668

MADB-10-000400 - MariaDB must protect against a user falsely repudiating having performed organization-defined actions.

CAT|II

CCI|CCI-000166

Rule-ID|SV-253669r879554_rule

STIG-ID|MADB-10-000400

Vuln-ID|V-253669

MADB-10-000500 - MariaDB must provide audit record generation capability for DoD-defined auditable events within all DBMS/database components.

CCI|CCI-000169

Rule-ID|SV-253670r879559_rule

STIG-ID|MADB-10-000500

Vuln-ID|V-253670

MADB-10-000600 - MariaDB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

CCI|CCI-000171

Rule-ID|SV-253671r879560_rule

STIG-ID|MADB-10-000600

Vuln-ID|V-253671

MADB-10-000700 - MariaDB must be able to generate audit records when privileges/permissions are retrieved.

CCI|CCI-000172

Rule-ID|SV-253672r879561_rule

STIG-ID|MADB-10-000700

Vuln-ID|V-253672

MADB-10-000800 - MariaDB must be able to generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.

Rule-ID|SV-253673r879561_rule

STIG-ID|MADB-10-000800

Vuln-ID|V-253673

MADB-10-000900 - MariaDB must initiate session auditing upon startup.

CCI|CCI-001464

Rule-ID|SV-253674r879562_rule

STIG-ID|MADB-10-000900

Vuln-ID|V-253674

MADB-10-001000 - MariaDB must produce audit records containing sufficient information to establish what type of events occurred.

CCI|CCI-000130

Rule-ID|SV-253675r879563_rule

STIG-ID|MADB-10-001000

Vuln-ID|V-253675

MADB-10-001600 - MariaDB must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

CCI|CCI-000135

Rule-ID|SV-253676r879569_rule

STIG-ID|MADB-10-001600

Vuln-ID|V-253676

MADB-10-001700 - MariaDB must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

CCI|CCI-000140

Rule-ID|SV-253677r879571_rule

STIG-ID|MADB-10-001700

Vuln-ID|V-253677

MADB-10-001800 - MariaDB must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

Rule-ID|SV-253678r879571_rule

STIG-ID|MADB-10-001800

Vuln-ID|V-253678

MADB-10-002000 - The audit information produced by MariaDB must be protected from unauthorized read access.

CCI|CCI-000162

Rule-ID|SV-253679r879576_rule

STIG-ID|MADB-10-002000

Vuln-ID|V-253679

MADB-10-002100 - The audit information produced by MariaDB must be protected from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-253680r879577_rule

STIG-ID|MADB-10-002100

Vuln-ID|V-253680

MADB-10-002200 - The audit information produced by MariaDB must be protected from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-253681r879578_rule

STIG-ID|MADB-10-002200

Vuln-ID|V-253681

MADB-10-002300 - MariaDB must protect its audit features from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-253682r879579_rule

STIG-ID|MADB-10-002300

Vuln-ID|V-253682

MADB-10-002400 - MariaDB must protect its audit configuration from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-253683r879580_rule

STIG-ID|MADB-10-002400

Vuln-ID|V-253683

MADB-10-002500 - MariaDB must protect its audit features from unauthorized removal.

CCI|CCI-001495

Rule-ID|SV-253684r879581_rule

STIG-ID|MADB-10-002500

Vuln-ID|V-253684

MADB-10-002600 - MariaDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the DBMS.

CCI|CCI-001499

Rule-ID|SV-253685r879586_rule

STIG-ID|MADB-10-002600

Vuln-ID|V-253685

MADB-10-002700 - The MariaDB software installation account must be restricted to authorized users.

Rule-ID|SV-253686r879586_rule

STIG-ID|MADB-10-002700

Vuln-ID|V-253686

MADB-10-002800 - Database software, including MariaDB configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

Rule-ID|SV-253687r879586_rule

STIG-ID|MADB-10-002800

Vuln-ID|V-253687

MADB-10-002900 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MariaDB, etc.) must be owned by database/MariaDB principals authorized for ownership.

Rule-ID|SV-253688r879586_rule

STIG-ID|MADB-10-002900

Vuln-ID|V-253688

MADB-10-003000 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the MariaDB, etc.) must be restricted to authorized users.

Rule-ID|SV-253689r879586_rule

STIG-ID|MADB-10-003000

Vuln-ID|V-253689

MADB-10-003100 - Default demonstration and sample databases, database objects, and applications must be removed.

CCI|CCI-000381

Rule-ID|SV-253690r879587_rule

STIG-ID|MADB-10-003100

Vuln-ID|V-253690

MADB-10-003200 - Unused database components, DBMS software, and database objects must be removed.

Rule-ID|SV-253691r879587_rule

STIG-ID|MADB-10-003200

Vuln-ID|V-253691

MADB-10-003400 - Access to external executables must be disabled or restricted.

Rule-ID|SV-253692r879587_rule

STIG-ID|MADB-10-003400

Vuln-ID|V-253692

MADB-10-003500 - MariaDB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CCI|CCI-000382

Rule-ID|SV-253693r879588_rule

STIG-ID|MADB-10-003500

Vuln-ID|V-253693

MADB-10-003600 - MariaDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-253694r879589_rule

STIG-ID|MADB-10-003600

Vuln-ID|V-253694

MADB-10-003700 - If MariaDB authentication, using passwords, is employed, then MariaDB must enforce the DoD standards for password complexity.

CCI|CCI-000192

Rule-ID|SV-253695r879601_rule

STIG-ID|MADB-10-003700

Vuln-ID|V-253695

MADB-10-003750 - If MariaDB authentication using passwords is employed, MariaDB must enforce the DoD standards for password lifetime.

Rule-ID|SV-253696r879601_rule

STIG-ID|MADB-10-003750

Vuln-ID|V-253696

MADB-10-003800 - If passwords are used for authentication, MariaDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-253697r879608_rule

STIG-ID|MADB-10-003800

Vuln-ID|V-253697

MADB-10-003900 - If passwords are used for authentication, MariaDB must transmit only encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-253698r879609_rule

STIG-ID|MADB-10-003900

Vuln-ID|V-253698

MADB-10-004000 - MariaDB, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-253699r879612_rule

STIG-ID|MADB-10-004000

Vuln-ID|V-253699

MADB-10-004100 - MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.

CCI|CCI-000186

Rule-ID|SV-253700r879613_rule

STIG-ID|MADB-10-004100

Vuln-ID|V-253700

MADB-10-004200 - MariaDB must map PKI ID to an associated user account.

CCI|CCI-000187

Rule-ID|SV-253701r879614_rule

STIG-ID|MADB-10-004200

Vuln-ID|V-253701

MADB-10-004300 - MariaDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

CCI|CCI-000206

Rule-ID|SV-253702r879615_rule

STIG-ID|MADB-10-004300

Vuln-ID|V-253702

MADB-10-004400 - MariaDB must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.

CCI|CCI-000803

Rule-ID|SV-253703r879616_rule

STIG-ID|MADB-10-004400

Vuln-ID|V-253703

MADB-10-004500 - The MariaDB must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

CCI|CCI-000804

Rule-ID|SV-253704r879617_rule

STIG-ID|MADB-10-004500

Vuln-ID|V-253704

MADB-10-004600 - MariaDB must separate user functionality (including user interface services) from database management functionality.

CCI|CCI-001082

Rule-ID|SV-253705r879631_rule

STIG-ID|MADB-10-004600

Vuln-ID|V-253705

MADB-10-004700 - MariaDB must invalidate session identifiers upon user logout or other session termination.

CCI|CCI-001185

Rule-ID|SV-253706r879637_rule

STIG-ID|MADB-10-004700

Vuln-ID|V-253706

MADB-10-004900 - MariaDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

Detections

Analytics

DISA MariaDB Enterprise 10.x v1r3 DB

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Aug 28, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Jun 17, 2024 Miscellaneous Metadata updated.