STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 must map the PKI-authenticated identity to an associated user account.

DISA Rule

SV-235136r638812_rule

Vulnerability Number

V-235136

Group Title

SRG-APP-000177-DB-000069

Rule Version

MYS8-00-004900

Severity

CAT II

CCI(s)

• CCI-000187 - The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.

Weight

10

Fix Recommendation

Configure the MySQL Database Server 8.0 to map the authenticated identity directly to the MySQL Database Server 8.0 user account.

Alter users to require X509 certificates.

Below is an example to add X509 as a requirement.

For a new user:
CREATE USER 'jeffrey'@'localhost' REQUIRE X509;
AND SUBJECT '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Johan Smith'
AND ISSUER '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Some CA';

Or to add to an existing user:
ALTER USER 'johansmith'@'%'
REQUIRE X509
AND SUBJECT '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Johan Smith'
AND ISSUER '/C=US/ST=Texas/L=Houston/O=SomeCompany/CN=Some CA';

Check Contents

Review MySQL Database Server 8.0 configuration to verify DBMS user accounts are being mapped directly to unique identifying information within the validated PKI certificate.

Confirm Issuer and Subject map to the username. Run the following script:
SELECT `user`.`Host`,
`user`.`User`,
`user`.`ssl_type`,
CAST(`user`.`x509_issuer` as CHAR) as Issuer,
CAST(`user`.`x509_subject` as CHAR) as Subject
FROM `mysql`.`user`;

If user accounts are not being mapped to authenticated identities, this is a finding.

Vulnerability Number

V-235136

Documentable

False

Rule Version

MYS8-00-004900

Severity Override Guidance

Review MySQL Database Server 8.0 configuration to verify DBMS user accounts are being mapped directly to unique identifying information within the validated PKI certificate.

Confirm Issuer and Subject map to the username. Run the following script:
SELECT `user`.`Host`,
`user`.`User`,
`user`.`ssl_type`,
CAST(`user`.`x509_issuer` as CHAR) as Issuer,
CAST(`user`.`x509_subject` as CHAR) as Subject
FROM `mysql`.`user`;

If user accounts are not being mapped to authenticated identities, this is a finding.

Check Content Reference

M

Target Key

5277

Comments