MYSQL CISBenchmark Security Controls to be applied on MySQL Clusters

1. Ensure 'password_lifetime' is Less Than or Equal to '365'

INSTALL COMPONENT 'file://component_validate_password';

set persist default_password_lifetime = 365;

2. Ensure Password Complexity is Configured

set persist validate_password.check_user_name='ON';

set persist validate_password.dictionary_file='<FILENAME OF DICTIONARY FILE>';

set persist validate_password.length=14;

set persist validate_password.mixed_case_count=1;

set persist validate_password.special_char_count=1;

set persist validate_password.number_count=1;

3. Ensure Password Resets Require Strong Passwords

SET PERSIST password_history = 5;

SET PERSIST password_reuse_interval = 365;

4. Implement Connection Delays to Limit Failed Login Attempts

[mysqld]

plugin-load-add=connection_control.so

connection-control=FORCE_PLUS_PERMANENT

connection-control-failed-login-attempts=FORCE_PLUS_PERMANENT

connection_control_failed_connections_threshold=5

connection_control_min_connection_delay=60000

connection_control_max_connection_delay=1920000

ALTER USER <user> FAILED_LOGIN_ATTEMPTS 12;

5. Ensure the Audit Plugin Can't be Unloaded

audit_log = 'FORCE_PLUS_PERMANENT'
6. Ensure default_authentication_plugin is Set to a Secure
Option
default_authentication_plugin=caching_sha2_password

7. Ensure Passwords are Set for All MySQL Accounts

ALTER USER <user>@<host> IDENTIFIED BY RANDOM PASSWORD PASSWORD
EXPIRE;

8. Set 'default_password_lifetime' to Require a Yearly Password

Change
SET GLOBAL default_password_lifetime=365;

9. Ensure Password Complexity Policies are in Place

SET PERSIST validate_password.length=14;

SET PERSIST validate_password.check_user_name=ON;

SET PERSIST validate_password.dictionary_file=<path to dictionary file>;

SET PERSIST validate_password.policy=STRONG;

SET PERSIST validate_password.mixed_case_count=1;

SET PERSIST validate_password.number_count=1;

SET PERSIST validate_password.special_char_count=1;

10. Ensure No Users Have Wildcard Hostnames

SELECT user, host FROM mysql.user WHERE host = '%';

11. Ensure 'require_secure_transport' is Set to 'ON' and/or

'have_ssl' is Set to 'YES'
set persist require_secure_transport=ON;

12. Ensure 'ssl_type' is Set to 'ANY', 'X509', or 'SPECIFIED'

for All Remote Users
ALTER USER 'my_user'@'app1.example.com' REQUIRE X509;