2.17 Ensure Only Approved Ciphers are Used

Information

MySQL supports multiple encryption ciphers. Ciphers can vary in strength, speed and overhead.

Rationale:

Requiring clients attempting to connect to MySQL to use strong ciphers protects data in transit.

Impact:

Connections attempting to use an unsupported cipher will fail.

Solution

Set ssl_cipher and tls_ciphersuites in the mysql.conf to an approved cipher suite:

tls_ciphersuites='TLS_AES_256_GCM_SHA384'
ssl_cipher='ECDHE-ECDSA-AES128-GCM-SHA256'

Or

Execute the following commands:

set persist ssl_cipher='ECDHE-ECDSA-AES128-GCM-SHA256';
set persist tls_ciphersuites='TLS_AES_256_GCM_SHA384';

See Also

https://workbench.cisecurity.org/benchmarks/15112

Item Details

Category: SYSTEM AND SERVICES ACQUISITION

References: 800-53|SA-15, CSCv7|18.5

Plugin: MySQLDB

Control ID: ff4e807f4d5bf86fd81e52b0ae081a36ac19c6998e0f561578ad23556cb6f399