STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

DISA Rule

SV-253667r1136896_rule

Vulnerability Number

V-253667

Group Title

SRG-APP-000023-DB-000001

Rule Version

MADB-10-000200

Severity

CAT I

CCI(s)

• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

10

Fix Recommendation

Integrate MariaDB security with an organization-level authentication/access mechanism providing account management for all users, groups, roles, and any other principals.

As the database administrator, install and configure the PAM authentication module:

MariaDB> INSTALL SONAME 'auth_pam';

PAM supports many authentication methods including LDAP, Active Directory, and Kerberos. Each method must be configured properly in the /etc/pam.conf file or the /etc/pam.d directory.

To alter non-PAM authenticated users to using PAM:

MariaDB> ALTER USER 'username'@'host' IDENTIFIED VIA pam USING mariadb_ldap;

Check Contents

If all accounts are authenticated by the organization-level authentication/access mechanism, such as LDAP, Kerberos, or Active Directory, and not by MariaDB, this is not a finding.

If any accounts are managed by the DBMS, review the system documentation for justification and approval of these accounts.

If any DBMS-managed accounts exist that are not documented and approved, this is a finding.

As the OS administrator, review the configuration in the /etc/pam.conf file or the /etc/pam.d directory. If there are no configuration file(s), this is a finding.
Example for LDAP authentication and authorization via PAM would be /etc/pam.d/mariadb_ldap:

#############################
auth required pam_ldap.so
account required pam_ldap.so
#############################

Verify that PAM is installed:

MariaDB> SHOW PLUGINS;

If pam is not listed as active, this is a finding.

To find users not using PAM plugin for authentication:

MariaDB> SELECT user, host, plugin FROM mysql.user WHERE plugin != 'pam';

If any users are returned, this is a finding.

Vulnerability Number

V-253667

Documentable

False

Rule Version

MADB-10-000200

Severity Override Guidance

If all accounts are authenticated by the organization-level authentication/access mechanism, such as LDAP, Kerberos, or Active Directory, and not by MariaDB, this is not a finding.

If any accounts are managed by the DBMS, review the system documentation for justification and approval of these accounts.

If any DBMS-managed accounts exist that are not documented and approved, this is a finding.

As the OS administrator, review the configuration in the /etc/pam.conf file or the /etc/pam.d directory. If there are no configuration file(s), this is a finding.
Example for LDAP authentication and authorization via PAM would be /etc/pam.d/mariadb_ldap:

#############################
auth required pam_ldap.so
account required pam_ldap.so
#############################

Verify that PAM is installed:

MariaDB> SHOW PLUGINS;

If pam is not listed as active, this is a finding.

To find users not using PAM plugin for authentication:

MariaDB> SELECT user, host, plugin FROM mysql.user WHERE plugin != 'pam';

If any users are returned, this is a finding.

Check Content Reference

M

Target Key

5475