STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.

DISA Rule

SV-253735r1050788_rule

Vulnerability Number

V-253735

Group Title

SRG-APP-000389-DB-000372

Rule Version

MADB-10-008200

Severity

CAT II

CCI(s)

• CCI-004895 - Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.

Weight

10

Fix Recommendation

To force a single user reauthenticate, the user must be currently authenticated to the database server.

Find the process ID of the user in question:

MariaDB> SELECT id FROM information_schema.processlist WHERE user = 'username';

Use the id to kill the process, which kills the connection and forces the user to reauthenticate:

MariaDB> KILL id;

To force all users to reauthenticate, run the following as the database administrator:

MariaDB> SELECT concat( KILL ,id, ; ) FROM information_schema.processlist INTO OUTFILE /tmp/x.txt;

MariaDB> SOURCE /tmp/x.txt;

Check Contents

Determine all situations where a user must reauthenticate. Check if the mechanisms that handle such situations use the following SQL:

To make a single user reauthenticate, an existing connection must be present:

To search for a specific user:
MariaDB> SELECT * FROM information_schema.PROCESSLIST where user ='<name>' and host like '%';

To review all connections:
MariaDB> SELECT * FROM INFORMATION_SCHEMA.PROCESSLIST;

Note the ID(s) (processlist_id) of the connection(s) for the user that must reauthenticate.

To make a user reauthenticate, run the following for each ID returned above (as they can have multiple connections):

MariaDB> KILL CONNECTION processslist_id;

If the provided SQL does not force reauthentication, this is a finding.

Vulnerability Number

V-253735

Documentable

False

Rule Version

MADB-10-008200

Severity Override Guidance

Determine all situations where a user must reauthenticate. Check if the mechanisms that handle such situations use the following SQL:

To make a single user reauthenticate, an existing connection must be present:

To search for a specific user:
MariaDB> SELECT * FROM information_schema.PROCESSLIST where user ='<name>' and host like '%';

To review all connections:
MariaDB> SELECT * FROM INFORMATION_SCHEMA.PROCESSLIST;

Note the ID(s) (processlist_id) of the connection(s) for the user that must reauthenticate.

To make a user reauthenticate, run the following for each ID returned above (as they can have multiple connections):

MariaDB> KILL CONNECTION processslist_id;

If the provided SQL does not force reauthentication, this is a finding.

Check Content Reference

M

Target Key

5475