1.3 Disable MariaDB Command History - ~/.mysql_history

Information

On Unix, the mysql client writes a record of executed statements to a history file. By default, this file is named .mysql_history and is created in your home directory. To specify a different file, set the value of the MYSQL_HISTFILE environment variable.

The .mysql_history file should be protected with a restrictive access mode because sensitive information might be written to it, such as the text of SQL statements that contain passwords.

Rationale:

Disabling the MariaDB Client and MariaDB Shell command history reduces the probability of exposing sensitive information, such as passwords, encryption keys, or other sensitive data or information.

Solution

For MariaDB Client perform the following steps to remediate this setting:

Remove .mysql_history if it exists.

Use either of the techniques below to prevent it from being created again:

Set the MYSQL_HISTFILE environment variable to /dev/null. This will need to be placed in the shell's startup script.

Create .mysql_history as a symbolic to /dev/null.

> ln -s /dev/null $HOME/.mysql_history

Default Value:

By default, the MariaDB command history file is located in /root/.mysql_history.

See Also

https://workbench.cisecurity.org/benchmarks/16527

Item Details

Category: MEDIA PROTECTION

References: 800-53|MP-6, CSCv7|13.2

Plugin: Unix

Control ID: e095b5309683c6880b8bac797b6510c32e9a953e704425d217caf0c8dfc1f43e