Ensure only approved ciphers are used for Replication

MediumLevel 2Manual reviewmariadb

Description

MariaDB supports multiple encryption ciphers that can be used for TLS connections during replication. Ciphers can vary in strength, speed and overhead.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

If replication uses TLS, run SHOW REPLICA STATUS\G on the replica and verify Master_SSL_Cipher lists only approved ciphers/cipher suites. An empty value or unapproved ciphers is a fail.

How it is fixed

Fix method: Guidance or infrastructure patch

STOP REPLICA; CHANGE MASTER TO MASTER_SSL_CIPHER = '<approved cipher list>'; START REPLICA;

Properties

Operating systems: Any
Tags: mariadbdatabasereplicationtlsmanual
Reference: CIS MariaDB 10.11 Benchmark v1.0.0 - 9.4 Ensure only approved ciphers are used for Replication