STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

The audit information produced by MariaDB must be protected from unauthorized deletion.

DISA Rule

SV-253681r960936_rule

Vulnerability Number

V-253681

Group Title

SRG-APP-000120-DB-000061

Rule Version

MADB-10-002200

Severity

CAT II

CCI(s)

• CCI-000164 - Protect audit information from unauthorized deletion.

Weight

10

Fix Recommendation

If the audit.log file permissions do not comply with organization's standards, change the permissions. Example:

$ chown user:group /path/to/audit.log
$ chmod 660 /path/to/audit.log

If the MariaDB server is configured to use syslog for logging, consult the organization's syslog setting for permissions and ownership of logs with respect to who can modify them.

Check Contents

Determine if the MariaDB Enterprise Audit plugin is logging to a file or syslog.

MariaDB> SHOW GLOBAL VARIABLES LIKE 'server_audit_output_type';

If FILE, find the location of the audit log:

MariaDB> SHOW GLOBAL VARIABLES LIKE 'server_audit_file_path';

If FILE, check the permission of the file:

$ sudo ls -al /path/to/audit.log

Consult the organization's security guide on acceptable permissions and ownership of logs with respect to who can modify them. Verify the log files have the set configurations.

If the permissions are not set to the organization's standards, this is a finding.

If the MariaDB server is configured to use syslog for logging, consult the organization's syslog setting for permissions and ownership of logs with respect to who can modify them.

Vulnerability Number

V-253681

Documentable

False

Rule Version

MADB-10-002200

Severity Override Guidance

Determine if the MariaDB Enterprise Audit plugin is logging to a file or syslog.

MariaDB> SHOW GLOBAL VARIABLES LIKE 'server_audit_output_type';

If FILE, find the location of the audit log:

MariaDB> SHOW GLOBAL VARIABLES LIKE 'server_audit_file_path';

If FILE, check the permission of the file:

$ sudo ls -al /path/to/audit.log

Consult the organization's security guide on acceptable permissions and ownership of logs with respect to who can modify them. Verify the log files have the set configurations.

If the permissions are not set to the organization's standards, this is a finding.

If the MariaDB server is configured to use syslog for logging, consult the organization's syslog setting for permissions and ownership of logs with respect to who can modify them.

Check Content Reference

M

Target Key

5475