STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.

DISA Rule

SV-253700r961041_rule

Vulnerability Number

V-253700

Group Title

SRG-APP-000176-DB-000068

Rule Version

MADB-10-004100

Severity

CAT I

CCI(s)

• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.

Weight

10

Fix Recommendation

If the SSL files are not secured properly in the file system, change the ownership and permissions with operating system operations.

Example:

chown mysql:mysql /path/to/file
chmod 440 /path/to/file

Check Contents

First, as the database administrator, verify the following settings: Note: If no specific directory given before the filename, the files are stored in DATADIR.

MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_ca';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_cert';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_key';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_crlpath';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'datadir';

Verify the permissions of the above files.

Example:

ls -al /path/to/ssl_cert

MariaDB Enterprise Server runs as the mysql operating system user, thus should be owned by user mysql and group mysql with user read and group read file level permissions.

Example:

-r-------. 1 mysql

If the files and directories are not properly secured, this is a finding.

Vulnerability Number

V-253700

Documentable

False

Rule Version

MADB-10-004100

Severity Override Guidance

First, as the database administrator, verify the following settings: Note: If no specific directory given before the filename, the files are stored in DATADIR.

MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_ca';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_cert';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_key';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_crlpath';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'datadir';

Verify the permissions of the above files.

Example:

ls -al /path/to/ssl_cert

MariaDB Enterprise Server runs as the mysql operating system user, thus should be owned by user mysql and group mysql with user read and group read file level permissions.

Example:

-r-------. 1 mysql

If the files and directories are not properly secured, this is a finding.

Check Content Reference

M

Target Key

5475