Ensure Binary and Relay Logs are Encrypted

OrtaDüzey 2Otomatikmariadb

Açıklama

The encrypt_binlog system variable may be used to configure encryption of the binary and relay logs. This may be configured to ON even if binary logging is not enabled in order to encrypt relay log files. encrypt_binlog also encrypts relay logs. Runs mariadb -NBe with the client defaults: as root on the server the unix_socket plugin usually authenticates; otherwise put an administrative account in ~/.my.cnf (mode 0600), not MYSQL_PWD (see 1.4/1.6).

Nasıl denetlenir

Denetim yöntemi: SQL sorgusu

sql_query

out=$(mariadb -NBe "SELECT IF(@@global.encrypt_binlog = 1, 'compliant', 'noncompliant')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Set encrypt_binlog=ON under [mariadbd] in /etc/mysql/mariadb.conf.d/50-server.cnf (or /etc/my.cnf.d/server.cnf) (requires a key management plugin), then restart MariaDB.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: mariadbdatabaseencryptionbinlog
Referans: CIS MariaDB 10.11 Benchmark v1.0.0 - 6.6 Ensure Binary and Relay Logs are Encrypted

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target mariadb --level 2