1.3 Disable MySQL Command History

Information

On Linux/UNIX, the MySQL client and MySQL Shell log statements executed interactively to a history file. The default MySQL Client file is named .mysql_history in the user's home directory. The files are split by language and named history.sql, history.js and history.py. Most interactive commands run in the MySQL client application are saved to a history file. The MySQL command history should be disabled. By default, the MySQL Shell does not save history between sessions.

Rationale:

Disabling the MySQL Client and MySQL Shell command history reduces the probability of exposing sensitive information, such as passwords, encryption keys, or other sensitive data or information.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Perform the following steps to remediate this setting:

Remove .mysql_history if it exists.

Use either of the techniques below to prevent it from being created again:

Set the MYSQL_HISTFILE environment variable to /dev/null. This will need to be placed in the shell's startup script.

Create $HOME/.mysql_history as a symbolic to /dev/null.

> ln -s /dev/null $HOME/.mysql_history

Another way to prevent history from being recorded is to use --batch option.

Default Value:

By default, the MySQL command history file is located in $HOME/.mysql_history.

See Also

https://workbench.cisecurity.org/files/3844

Item Details

Category: MEDIA PROTECTION

References: 800-53|MP-6, CSCv7|13.2

Plugin: Windows

Control ID: b456cbd54fd3918d2e6dff7de8ce6e40fe30be863501a9f62c61ea4ddb4e3888