0

I'm looking to improve the security of my MariaDB installation by better auditing the user accounts and the privileges of each user account.

This database is being provided as a service out to many other users within the enterprise, and in some cases people leave the company or didn't actually need the level of privileges they requested. I'd like to audit the user accounts and see when they last logged in (to make sure users are logging in at least once every 90 days) and auditing the privileges their account has been granted.

Specifically, if possible, I'd like to look which privileges haven't been used within the past 90 days so that I can either alert our service team or (in the future) automatically revoke privileges which are not being used (with the exception of some of the disaster recovery accounts or security teams).

Any guidance on how to proceed with identifying account usage either in the general account access or in the more detailed privilege usage would be greatly appreciated.

  • 1
    I would advise against any automatic revocation of privileges and accounts unless it is something that is easy and quick to put back in place. There are reasons why something may not have been used in 90 days, such as nothing needed those privileges during that time and when they are removed something comes up that requires them. Also it is better to send out reports to review all privileges are needed rather then just the unneeded ones. If you just review the unused ones you can easily miss one that is being used when it shouldn't be there. – Joe W Nov 14 '18 at 19:57
1

The audit plugin, when enabled, will provide the access information associated with users accounts.

There are also authentication plugins to centrally manage authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.