MariaDB Enterprise 10.x Security Technical Implementation Guide

The MariaDB Enterprise 10.x Security Technical Implementation Guide (V2 R6) has 107 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

107STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Sep 30 2026

MariaDB must map PKI ID to an associated user account.

MariaDB Enterprise 10.x Security Technical Implementation Guide

Assessment Title

Rule Text

MariaDB must map PKI ID to an associated user account.

Description

Discussion Text

The DoW standard for authentication is DoW-approved PKI certificates. Once a PKI is validated, it is mapped to the DBMS user account for the authentication identity and then can be used for authorization decisions.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-253701

Rule

SV-253701r1263680_rule

Severity

medium

Rule Version

MADB-10-004200

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Query all users to confirm issuer and subject are configured correctly: 

MariaDB>SELECT user, host, ssl_type, CAST(x509_issuer AS CHAR) AS issuer, CAST(x509_subject AS CHAR) AS subject FROM mysql.user;

If users are not mapped correctly, this is a finding.

Implementation Procedure

Fix Text

Example command to create users with proper X509 certificate subject and issuer: 

MariaDB>CREATE USER 'janedoe'@'%' IDENTIFIED BY 'Some_Password_Here_$9'
REQUIRE SUBJECT '/C=US/ST=Ohio/L=Columbus/O=MariaDB Corporation/CN=Jane Doe'
AND ISSUER '/C=US/ST=Ohio/L=Columbus/O=MariaDB Corporation/CN=MariaDB CA';

STIG check 36 of 107 in the MariaDB Enterprise 10.x STIG checklist

← Previous · V-253700MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.Next · V-253702 →MariaDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.