9.3 Ensure 'master_info_repository' is Set to 'TABLE'

Information

The master_info_repository setting, which is deprecated as of 8.0.22, determines to where a REPLICA (slave is deprecated as of 8.0.22) logs SOURCE status and connection information. The options are FILE or TABLE. Note also that this setting is associated with the sync_master_info, which is deprecated in 8.0.22, setting as well.

Rationale:

The password which the client uses is stored in the SOURCE info repository, which by default is a plaintext file. The TABLE SOURCE info repository is a bit safer, but with filesystem access it's still possible to gain access to the password the REPLICA is using.

Solution

Perform the following actions to remediate this setting:

Open the MySQL configuration file (my.cnf)

Locate master_info_repository

Set the master_info_repository value to TABLE

Note: If master_info_repository does not exist, add it to the configuration file.

Default Value:

TABLE

See Also

https://workbench.cisecurity.org/benchmarks/10139

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: MySQLDB

Control ID: 8bbf1c7565579e1cc99846b3e2138cabb1d48aeedf6531383efee9862064e88d