Ensure 'ssl_type' is Set to 'ANY', 'X509', or 'SPECIFIED' for All Remote Users

AltaNivel 1Automatizadamariadb

Descripción

All network traffic must use SSL/TLS when traveling over untrusted networks. SSL/TLS should be enforced on a per-user basis for users which enter the system through the network. Counts remote accounts whose ssl_type is not ANY, X509 or SPECIFIED. Runs mariadb -NBe with the client defaults: as root on the server the unix_socket plugin usually authenticates; otherwise put an administrative account in ~/.my.cnf (mode 0600), not MYSQL_PWD (see 1.4/1.6).

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

out=$(mariadb -NBe "SELECT COUNT(*) FROM mysql.user WHERE host NOT IN ('::1', '127.0.0.1', 'localhost') AND ssl_type NOT IN ('ANY', 'X509', 'SPECIFIED')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

ALTER USER '<user>'@'<host>' REQUIRE X509; (or REQUIRE SSL / ISSUER / SUBJECT) for every remote account listed by SELECT user, host, ssl_type FROM mysql.user WHERE host NOT IN ('::1','127.0.0.1','localhost');

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: mariadbdatabasetlsauthentication
Referencia: CIS MariaDB 10.11 Benchmark v1.0.0 - 8.2 Ensure 'ssl_type' is Set to 'ANY', 'X509', or 'SPECIFIED' for All Remote Users

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target mariadb