STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

If passwords are used for authentication, MariaDB must transmit only encrypted representations of passwords.

DISA Rule

SV-253698r961029_rule

Vulnerability Number

V-253698

Group Title

SRG-APP-000172-DB-000075

Rule Version

MADB-10-003900

Severity

CAT I

CCI(s)

CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

Fix Recommendation

As the administrator locate the MariaDB configuration file to change. This varies depending on setup and how configuration files are managed but should be in /etc/my.cnf.d/. It is recommended to have a separate configuration file within this directory for SSL connection information.

In the [server] section add the lines for SSL:

ssl
ssl-ca=/path/to/ssl/ca-cert.pem
ssl-cert=/path/to/ssl/server-cert.pem
ssl-key=/path/to/ssl/server-key.pem

Restart of the MariaDB Server and verify SSL is being used.

MariaDB> STATUS;

Verify line beginning with "SSL:".

Check Contents

MariaDB by default only sends passwords encrypted. However, when authenticating via the PAM Authentication Plugin, the password is sent in cleartext. Thus when using PAM authentication, it is recommended to use TLS/SSL encryption for all database connections.

If using PAM authentication, verify TLS/SSL is in use.

Run the following database command:

MariaDB> STATUS;

Verify the line which starts with "SSL:" is as expected. If it returns "Not in use", this is a finding.

Vulnerability Number

V-253698

Documentable

False

Rule Version

MADB-10-003900

Severity Override Guidance

Check Content Reference

Target Key

5475