STIGQter: STIG Summary: Jamf Pro v10.x EMM Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Jul 2024:

Separate MySQL user accounts with limited privileges must be created within Jamf Pro EMM.

DISA Rule

SV-241801r971326_rule

Vulnerability Number

V-241801

Group Title

PP-MDM-991000

Rule Version

JAMF-10-100100

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Create separate MySQL user accounts with limited privileges within Jamf Pro EMM.

The procedures for creating user accounts and assigning account privileges are found in the following Jamf Knowledge Base articles:

MySQL 8.0: https://dev.mysql.com/doc/refman/8.0/en/creating-accounts.html
MySQL 5.7: https://dev.mysql.com/doc/refman/5.7/en/creating-accounts.html

Following is a list MySQL privileges that are required for different types of environments:
- For a standalone web application or the master node in clustered environments:
INSERT, SELECT, UPDATE, DELETE, CREATE, DROP, ALTER, INDEX, LOCK TABLES

- For a child node in clustered environments:
INSERT, SELECT, UPDATE, DELETE, DROP, LOCK TABLES

- To view connections from cluster nodes with different MySQL users:
PROCESS

Note: The "PROCESS" privilege requires the use of "*.*".

Check Contents

Verify separate MySQL user accounts with limited privileges have been created within Jamf Pro EMM.

In MySQL, execute the following command:
show grants for username@localhost;

Verify the privileges match what is in the Jamf Knowledge Base article.

If separate MySQL user accounts with limited privileges have not been created within Jamf Pro EMM, this is a finding.

Vulnerability Number

V-241801

Documentable

False

Rule Version

JAMF-10-100100

Severity Override Guidance

Verify separate MySQL user accounts with limited privileges have been created within Jamf Pro EMM.

In MySQL, execute the following command:
show grants for username@localhost;

Verify the privileges match what is in the Jamf Knowledge Base article.

If separate MySQL user accounts with limited privileges have not been created within Jamf Pro EMM, this is a finding.

Check Content Reference

M

Target Key

5357