STIGQter STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 must separate user functionality (including user interface services) from database management functionality.

DISA Rule

SV-235150r638812_rule

Vulnerability Number

V-235150

Group Title

SRG-APP-000211-DB-000122

Rule Version

MYS8-00-006400

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure MySQL Database Server 8.0 to separate database administration and general user functionality.

Revoke or remove users with admin and user mixed permissions.

Review MySQL documentation related to access controls for users and admins: https://dev.mysql.com/doc/refman/8.0/en/access-control.html.

Check Contents

Check MySQL settings and documentation to verify that administrative functionality is separate from user functionality.

As Database Administrator (DBA) (“root"), list all roles and permissions for the database:

> mysql -u root -p

SELECT user,host, 'Global Priv', Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv,
Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv,
Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv,
Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv,
Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv,
Create_routine_priv, Alter_routine_priv, Create_user_priv,
Event_priv, Trigger_priv, Create_tablespace_priv, Create_role_priv,
Drop_role_priv
FROM mysql.user WHERE 'Y' IN
(Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv,
Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv,
Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv,
Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv,
Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv,
Create_routine_priv, Alter_routine_priv, Create_user_priv,
Event_priv, Trigger_priv, Create_tablespace_priv, Create_role_priv,
Drop_role_priv)
AND user not in ('mysql.infoschema', 'mysql.session');

If any non-administrative role has permissions, other than mysql.infoschema and mysql.session, this is a finding.

If administrator and general user functionality are not separated, this is a finding.

Vulnerability Number

V-235150

Documentable

False

Rule Version

MYS8-00-006400

Severity Override Guidance

Check MySQL settings and documentation to verify that administrative functionality is separate from user functionality.

As Database Administrator (DBA) (“root"), list all roles and permissions for the database:

> mysql -u root -p

SELECT user,host, 'Global Priv', Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv,
Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv,
Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv,
Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv,
Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv,
Create_routine_priv, Alter_routine_priv, Create_user_priv,
Event_priv, Trigger_priv, Create_tablespace_priv, Create_role_priv,
Drop_role_priv
FROM mysql.user WHERE 'Y' IN
(Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv,
Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv,
Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv,
Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv,
Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv,
Create_routine_priv, Alter_routine_priv, Create_user_priv,
Event_priv, Trigger_priv, Create_tablespace_priv, Create_role_priv,
Drop_role_priv)
AND user not in ('mysql.infoschema', 'mysql.session');

If any non-administrative role has permissions, other than mysql.infoschema and mysql.session, this is a finding.

If administrator and general user functionality are not separated, this is a finding.

Check Content Reference

M

Target Key

5277

Comments