Disable use of the mysql_old_password plugin

높음레벨 1자동mariadb

설명

The mysql_old_password plugin uses a cracked password routine with several flaws. It is present but not used by default in MariaDB. Steps should be taken to ensure that passwords will not be created with this plugin and that clients will not be able to authenticate to the MariaDB server using this plugin. Requires old_passwords OFF and secure_auth ON. Runs mariadb -NBe with the client defaults: as root on the server the unix_socket plugin usually authenticates; otherwise put an administrative account in ~/.my.cnf (mode 0600), not MYSQL_PWD (see 1.4/1.6).

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(mariadb -NBe "SELECT IF(@@global.old_passwords = 0 AND @@global.secure_auth = 1, 'compliant', 'noncompliant')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set old_passwords=0 and secure_auth=ON under [mariadbd] in /etc/mysql/mariadb.conf.d/50-server.cnf (or /etc/my.cnf.d/server.cnf), then restart MariaDB.

속성

운영 체제: 모두
태그: mariadbdatabaseauthentication
참고 자료: CIS MariaDB 10.11 Benchmark v1.0.0 - 7.1 Disable use of the mysql_old_password plugin

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mariadb