6.8 Ensure the Audit Plugin Can't be Unloaded

Information

Set audit_log to FORCE_PLUS_PERMANENT

Rationale:

This disables unloading of the plugin.

Impact:

If someone can unload the plugin it would be possible to perform actions on the database without audit events being logged to the audit log. If the audit log plugin can be unloaded the audit log can be temporarily or permanently disabled.

Solution

To remediate this setting, follow these steps:

Open the MySQL configuration file (my.cnf)

Ensure the following line is found in the mysqld section

audit_log = 'FORCE_PLUS_PERMANENT'

Default Value:

ON

See Also

https://workbench.cisecurity.org/files/3855

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: MySQLDB

Control ID: 726e943774fb13502cbb2805d66ed716ee346165d0c066e2b779dafcbf1875d7