3.3 Ensure 'log_error' Has Appropriate Permissions

Information

MySQL can operate using a variety of log files, each used for different purposes. These are the binary log (which can be encrypted), error log, slow query log, relay log, general log, and in the enterprise edition, the audit log (which can be encrypted). Because these are files on the host operating system, they are subject to the permissions and ownership structure provided by the host and may be accessible by users other than the MySQL user. Additionally, using secure key management and at rest MySQL encryption can further protect data from OS users.

Much of the information about the state of MySQL exists in MySQL, the MySQL performance_schema or informations_schema. In cases where the information you need is within a running MySQL, use these methods as they are more secure as they do not require OS login and access.

Rationale:

Limiting the accessibility of these objects will protect the confidentiality, integrity, and availability of the MySQL logs.

Impact:

Changing the permissions of the error log files might have impact on monitoring tools which use an error log file adapter.

Solution

Execute the following command for each log file location requiring corrected permissions and ownership:

chmod 600 <log file>
chown mysql:mysql <log file>

See Also

https://workbench.cisecurity.org/files/3855

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: MySQLDB

Control ID: c27c5f93308e93778cf3b4e01d40f3597674a3daa858246f8dacf95f17dd5727