Ensure Binary and Relay Logs are Encrypted

보통레벨 2자동mariadb

설명

The encrypt_binlog system variable may be used to configure encryption of the binary and relay logs. This may be configured to ON even if binary logging is not enabled in order to encrypt relay log files. encrypt_binlog also encrypts relay logs. Runs mariadb -NBe with the client defaults: as root on the server the unix_socket plugin usually authenticates; otherwise put an administrative account in ~/.my.cnf (mode 0600), not MYSQL_PWD (see 1.4/1.6).

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(mariadb -NBe "SELECT IF(@@global.encrypt_binlog = 1, 'compliant', 'noncompliant')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set encrypt_binlog=ON under [mariadbd] in /etc/mysql/mariadb.conf.d/50-server.cnf (or /etc/my.cnf.d/server.cnf) (requires a key management plugin), then restart MariaDB.

속성

운영 체제: 모두
태그: mariadbdatabaseencryptionbinlog
참고 자료: CIS MariaDB 10.11 Benchmark v1.0.0 - 6.6 Ensure Binary and Relay Logs are Encrypted

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mariadb --level 2