STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 must be configured to provide audit record generation capability for DoD-defined auditable events within all database components.

DISA Rule

SV-235103r638812_rule

Vulnerability Number

V-235103

Group Title

SRG-APP-000089-DB-000064

Rule Version

MYS8-00-001600

Severity

CAT II

CCI(s)

• CCI-000169 - The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components.

Weight

10

Fix Recommendation

Deploy a MySQL Database Server 8.0 that supports the DoD minimum set of auditable events.

Configure the MySQL Database Server 8.0 to generate audit records for at least the DoD minimum set of events.

sudo vi /etc/my.cnf
[mysqld]
audit-log=FORCE_PLUS_PERMANENT
audit-log-format=JSON
audit-log-encryption=AES

After changing the my.cnf, restart the server.

SELECT audit_log_encryption_password_set(password);

Create auditing rules - for example:
Connect to MySQL and Use functions to define audit rules and audited users audit_log_filter_set,audit_log_filter_set_user

To log all auditable events:
SELECT audit_log_filter_set_filter('log_all', '{ "filter": { "log": true } }');

And to apply this log_all filter to all users:
SELECT audit_log_filter_set_user('%', 'log_all');

Check Contents

Check MySQL auditing to determine whether organization-defined auditable events are being audited by the system.

SELECT PLUGIN_NAME, plugin_status FROM INFORMATION_SCHEMA.PLUGINS
WHERE PLUGIN_NAME LIKE 'audit_log' ;

If nothing is returned OR if the results are not "audit_log" and "plugin_status='ACTIVE'" , this is a finding.

Next determine if the audit lot is encrypted.
SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables
WHERE VARIABLE_NAME LIKE 'audit_log_encryption' ;

If nothing is returned OR the value for audit_log_encryption is not "AES", this is a finding.

Vulnerability Number

V-235103

Documentable

False

Rule Version

MYS8-00-001600

Severity Override Guidance

Check MySQL auditing to determine whether organization-defined auditable events are being audited by the system.

SELECT PLUGIN_NAME, plugin_status FROM INFORMATION_SCHEMA.PLUGINS
WHERE PLUGIN_NAME LIKE 'audit_log' ;

If nothing is returned OR if the results are not "audit_log" and "plugin_status='ACTIVE'" , this is a finding.

Next determine if the audit lot is encrypted.
SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables
WHERE VARIABLE_NAME LIKE 'audit_log_encryption' ;

If nothing is returned OR the value for audit_log_encryption is not "AES", this is a finding.

Check Content Reference

M

Target Key

5277

Comments