STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must use NIST FIPS 140-2/140-3 validated cryptographic modules for cryptographic operations.

DISA Rule

SV-253703r1136902_rule

Vulnerability Number

V-253703

Group Title

SRG-APP-000179-DB-000114

Rule Version

MADB-10-004400

Severity

CAT I

CCI(s)

CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

Fix Recommendation

If crypto.fips_enabled = 0, for Red Hat Linux, configure the operating system to implement DOD-approved encryption by following the steps below:

To enable strict FIPS compliance, the fips=1 kernel option must be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place.

Enable FIPS mode with the following command:
# sudo fips-mode-setup --enable

Modify the kernel command line of the current kernel in the "grub.cfg" file by adding the following option to the GRUB_CMDLINE_LINUX key in the "/etc/default/grub" file and then rebuild the "grub.cfg" file:
fips=1

Changes to "/etc/default/grub" require rebuilding the "grub.cfg" file as follows:
On BIOS-based machines, use the following command:
# sudo grub2-mkconfig -o /boot/grub2/grub.cfg

On UEFI-based machines, use the following command:
# sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

If /boot or /boot/efi reside on separate partitions, the kernel parameter "boot=<partition of /boot or /boot/efi>" must be added to the kernel command line. Identify a partition by running the df /boot or df /boot/efi command:
# sudo df /boot

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda1 495844 53780 416464 12% /boot

To ensure the "boot=" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command:
# sudo blkid /dev/sda1
/dev/sda1: UUID="05c000f1-a213-759e-c7a2-f11b7424c797" TYPE="ext4"

For the example above, append the following string to the kernel command line:
boot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797

Reboot the system for the changes to take effect.

More information can be found here:
RedHat: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations
Ubuntu: https://security-certs.docs.ubuntu.com/en/fips

Check Contents

MariaDB relies on the underlying OS for FIPS compliance. Verify FIPS is enabled for the OS. Following are example Linux commands:
# sysctl crypto.fips_enabled
crypto.fips_enabled = 1

If crypto.fips_enabled = 0, this is a finding.
OR
$ sudo fips-mode-setup --check
FIPS mode is enabled.

If FIPS mode is not enabled, this is a finding.

Verify the server is using OpenSSL:
MariaDB> SHOW GLOBAL VARIABLES LIKE '%have_openssl';

If the value of have_openssl is not YES, this is a finding.

MariaDB> SHOW GLOBAL VARIABLES LIKE '%version_ssl_library%';
Note: FIPS-compliant libraries for OpenSSL 1.x.x contain "fips" in the version.

If the value of version_ssl_library is not FIPS compliant, this is a finding.

If using OpenSSL 3.x , check the providers:
openssl list -providers

Providers:
default
name: OpenSSL Default Provider
version: 3.2.2
status: active

fips
name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider
version: 3.2.2-622cc79c634cbbef
status: active

If the response does not list a FIPS provider with a status of "active", this is a finding.

Vulnerability Number

V-253703

Documentable

False

Rule Version

MADB-10-004400

Severity Override Guidance

Check Content Reference

Target Key

5475