CIS MariaDB 10.11 Benchmark

This recommendation verifies that MariaDB Runs Under a Dedicated User Account on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mariaDB Runs Under a Dedicated User Account may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ps -ef | grep -i mariadbd
# Process should run as 'mysql' user, not root

# In /etc/my.cnf.d/server.cnf under [mariadbd]:
[mariadbd]
user = mysql

This recommendation verifies that Data Directory Has Proper Permissions on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to data Directory Has Proper Permissions may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U:%G' /var/lib/mysql
# Should be 750 mysql:mysql

chown mysql:mysql /var/lib/mysql
chmod 750 /var/lib/mysql

This recommendation verifies that Log Files Have Proper Permissions on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to log Files Have Proper Permissions may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U:%G' /var/log/mariadb/*.log

chown mysql:mysql /var/log/mariadb/*.log
chmod 640 /var/log/mariadb/*.log

This recommendation verifies that MariaDB Is Running on a Dedicated Server on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mariaDB Is Running on a Dedicated Server may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify no web servers, app servers, or other services sharing the host
ss -tlnp | grep -v mariadbd

# Migrate MariaDB to a dedicated host or VM
# Remove unnecessary services from the database server

This recommendation verifies that the Latest Stable Version Is Installed on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Latest Stable Version Is Installed may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

mariadbd --version
# Or from SQL:
SELECT VERSION();

# Update to latest 10.11.x patch:
dnf update MariaDB-server   # RHEL/Rocky
apt upgrade mariadb-server   # Debian/Ubuntu

Anonymous Accounts should be removed from the MariaDB 10.11 database server when not required. Removing unnecessary components reduces the attack surface and limits the number of potential vulnerabilities that need to be managed.

Retaining Anonymous Accounts when it is not needed increases the attack surface. Unpatched or unused components are frequent targets for exploitation and should be removed as part of system hardening.

SELECT User, Host FROM mysql.user WHERE User = '';
-- Should return empty result set

DROP USER ''@'localhost';
DROP USER ''@'%';
FLUSH PRIVILEGES;

'test' Database should be removed from the MariaDB 10.11 database server when not required. Removing unnecessary components reduces the attack surface and limits the number of potential vulnerabilities that need to be managed.

Retaining 'test' Database when it is not needed increases the attack surface. Unpatched or unused components are frequent targets for exploitation and should be removed as part of system hardening.

SHOW DATABASES LIKE 'test';
-- Should return empty result set

DROP DATABASE test;
DELETE FROM mysql.db WHERE Db = 'test' OR Db = 'test\\_%';
FLUSH PRIVILEGES;

This recommendation verifies that Root Login Is Restricted to localhost on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to root Login Is Restricted to localhost may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT User, Host FROM mysql.user WHERE User = 'root';
-- Host should be only 'localhost' or '127.0.0.1'

DELETE FROM mysql.user WHERE User = 'root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
FLUSH PRIVILEGES;

This recommendation verifies that Password Validation Plugin Is Active on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Validation Plugin Is Active may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SHOW GLOBAL VARIABLES LIKE 'simple_password_check%';
SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS
WHERE PLUGIN_NAME = 'simple_password_check';

INSTALL SONAME 'simple_password_check';

-- In /etc/my.cnf.d/server.cnf:
[mariadbd]
plugin_load_add = simple_password_check
simple_password_check_minimal_length = 14
simple_password_check_digits = 1
simple_password_check_letters_same_case = 1
simple_password_check_other_characters = 1

This recommendation verifies that ed25519 Authentication Is Preferred on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to ed25519 Authentication Is Preferred may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT User, Host, plugin FROM mysql.user;
-- Prefer 'ed25519' or 'mysql_native_password' (avoid 'mysql_old_password')

INSTALL SONAME 'auth_ed25519';
ALTER USER 'appuser'@'%' IDENTIFIED VIA ed25519 USING PASSWORD('SecurePass!');

This recommendation verifies that 'bind-address' Is Set on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'bind-address' Is Set may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SHOW GLOBAL VARIABLES LIKE 'bind_address';
-- Should not be '0.0.0.0' or '::'

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
bind-address = 127.0.0.1

This recommendation verifies that 'skip-networking' Is Enabled When Appropriate on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'skip-networking' Is Enabled When Appropriate may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SHOW GLOBAL VARIABLES LIKE 'skip_networking';
-- Should be ON if only local connections are needed

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
skip-networking = 1

This setting controls whether 'local-infile' is disabled on the MariaDB 10.11 database server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving 'local-infile' enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the MariaDB 10.11 database server.

SHOW GLOBAL VARIABLES LIKE 'local_infile';
-- Should be OFF

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
local-infile = 0

This recommendation verifies that TLS Is Enabled for Client Connections on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tLS Is Enabled for Client Connections may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SHOW GLOBAL VARIABLES LIKE 'have_ssl';
-- Should be YES
SHOW GLOBAL VARIABLES WHERE Variable_name IN ('ssl_cert','ssl_key','ssl_ca');

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
ssl_cert = /etc/pki/tls/certs/mariadb-server.pem
ssl_key  = /etc/pki/tls/private/mariadb-server-key.pem
ssl_ca   = /etc/pki/tls/certs/ca-bundle.pem
tls_version = TLSv1.2,TLSv1.3

This recommendation verifies that 'require_secure_transport' Is ON on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to 'require_secure_transport' Is ON may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SHOW GLOBAL VARIABLES LIKE 'require_secure_transport';
-- Should be ON

SET GLOBAL require_secure_transport = ON;

# Persistent in /etc/my.cnf.d/server.cnf:
[mariadbd]
require_secure_transport = ON

This setting controls whether Error Logging is enabled on the MariaDB 10.11 database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via my.cnf, MariaDB configuration, or SQL commands.

Without Error Logging enabled, the MariaDB 10.11 database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

SHOW GLOBAL VARIABLES LIKE 'log_error';
-- Should point to a file path

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
log_error = /var/log/mariadb/mariadb-error.log

This setting controls whether Slow Query Logging is enabled on the MariaDB 10.11 database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via my.cnf, MariaDB configuration, or SQL commands.

Without Slow Query Logging enabled, the MariaDB 10.11 database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

SHOW GLOBAL VARIABLES LIKE 'slow_query_log';
SHOW GLOBAL VARIABLES LIKE 'long_query_time';

SET GLOBAL slow_query_log = ON;
SET GLOBAL long_query_time = 2;

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
slow_query_log = 1
slow_query_log_file = /var/log/mariadb/mariadb-slow.log
long_query_time = 2

This recommendation verifies that the MariaDB Audit Plugin Is Installed on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the MariaDB Audit Plugin Is Installed may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS
WHERE PLUGIN_NAME = 'SERVER_AUDIT';
-- Should show ACTIVE

INSTALL SONAME 'server_audit';

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
plugin_load_add = server_audit
server_audit_logging = ON
server_audit_events = CONNECT,QUERY_DDL,QUERY_DCL
server_audit_output_type = FILE
server_audit_file_path = /var/log/mariadb/server_audit.log

This recommendation addresses the proper configuration of Audit Log File Rotation on the MariaDB 10.11 database server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Audit Log File Rotation can lead to security gaps that may be exploited by attackers. A properly configured MariaDB 10.11 database server reduces exposure to both known vulnerabilities and configuration drift.

SHOW GLOBAL VARIABLES LIKE 'server_audit_file_rotate%';

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
server_audit_file_rotate_size = 10485760
server_audit_file_rotations = 15

This recommendation verifies that Only Administrative Users Have SUPER Privilege on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to only Administrative Users Have SUPER Privilege may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT User, Host FROM mysql.user WHERE Super_priv = 'Y';
-- Should only show administrative accounts

REVOKE SUPER ON *.* FROM 'appuser'@'%';
FLUSH PRIVILEGES;

This setting ensures that FILE Privilege is restricted on the MariaDB 10.11 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted FILE Privilege could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the MariaDB 10.11 database server is essential for defense in depth.

SELECT User, Host FROM mysql.user WHERE File_priv = 'Y';
-- Should be minimal

REVOKE FILE ON *.* FROM 'appuser'@'%';
FLUSH PRIVILEGES;

This setting ensures that PROCESS Privilege is restricted on the MariaDB 10.11 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted PROCESS Privilege could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the MariaDB 10.11 database server is essential for defense in depth.

SELECT User, Host FROM mysql.user WHERE Process_priv = 'Y';

REVOKE PROCESS ON *.* FROM 'appuser'@'%';
FLUSH PRIVILEGES;

This recommendation verifies that No Wildcard Hosts Exist in User Accounts on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no Wildcard Hosts Exist in User Accounts may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT User, Host FROM mysql.user WHERE Host = '%';
-- Review and restrict as needed

-- Replace wildcard with specific host:
RENAME USER 'appuser'@'%' TO 'appuser'@'10.0.1.%';
FLUSH PRIVILEGES;

This recommendation verifies that Grants Are Minimal and Specific on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to grants Are Minimal and Specific may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SELECT * FROM mysql.db WHERE Db = '*';
-- No application user should have grants on all databases

-- Grant only needed privileges on specific databases:
GRANT SELECT, INSERT, UPDATE ON appdb.* TO 'appuser'@'10.0.1.%';
FLUSH PRIVILEGES;

This setting ensures that Replication Traffic uses encryption on the MariaDB 10.11 database server. Encrypting data in transit and at rest protects sensitive information from interception and unauthorized disclosure.

Without encryption, Replication Traffic may transmit or store sensitive information in cleartext, exposing it to interception, eavesdropping, or tampering. Encryption is a critical control for data confidentiality and integrity.

SHOW REPLICA STATUS\G
-- Check Master_SSL_Allowed = Yes

CHANGE MASTER TO
  MASTER_SSL = 1,
  MASTER_SSL_CA = '/etc/pki/tls/certs/ca-bundle.pem',
  MASTER_SSL_CERT = '/etc/pki/tls/certs/replica.pem',
  MASTER_SSL_KEY = '/etc/pki/tls/private/replica-key.pem';
START REPLICA;

This recommendation verifies that Replication User Has Minimal Privileges on the MariaDB 10.11 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to replication User Has Minimal Privileges may leave the MariaDB 10.11 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

SHOW GRANTS FOR 'repl_user'@'%';
-- Should only have REPLICATION SLAVE

GRANT REPLICATION SLAVE ON *.* TO 'repl_user'@'10.0.1.%' REQUIRE SSL;
FLUSH PRIVILEGES;

This setting controls whether Data-at-Rest Encryption is enabled on the MariaDB 10.11 database server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via my.cnf, MariaDB configuration, or SQL commands.

Without Data-at-Rest Encryption enabled, the MariaDB 10.11 database server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

SHOW GLOBAL VARIABLES LIKE 'innodb_encrypt_tables';
-- Should be ON or FORCE
SHOW GLOBAL VARIABLES LIKE 'encrypt_binlog';
SHOW GLOBAL VARIABLES LIKE 'encrypt_tmp_files';

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
plugin_load_add = file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile
file_key_management_encryption_algorithm = AES_CTR

innodb_encrypt_tables = FORCE
innodb_encrypt_log = ON
innodb_encryption_threads = 4
encrypt_binlog = ON
encrypt_tmp_files = ON

This recommendation addresses the proper configuration of Encryption Key Rotation on the MariaDB 10.11 database server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Encryption Key Rotation can lead to security gaps that may be exploited by attackers. A properly configured MariaDB 10.11 database server reduces exposure to both known vulnerabilities and configuration drift.

SHOW GLOBAL VARIABLES LIKE 'innodb_encryption_rotate_key_age';
-- Should be set to a reasonable value (e.g., 1 = rotate on every key version change)

# In /etc/my.cnf.d/server.cnf:
[mariadbd]
innodb_encryption_rotate_key_age = 1

# For AWS KMS-based key management:
# plugin_load_add = aws_key_management
# aws_key_management_master_key_id = alias/mariadb-key