Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-09-20 13:21:52 +00:00
Code Issues Projects Releases Packages Wiki Activity
ansible-collection-hardening/roles/mysql_hardening/README.md
schurzi 8e4c22d8d9
remove FQCN from roles in examples (#404) 
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.

Verified with Ansible 2.10.5

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
2021-02-17 11:34:37 +01:00

3.9 KiB
Raw Blame History

devsec.mysql_hardening

devsec.mysql_hardening

Description

This role provides security configurations for MySQL and its derivates. It is intended to set up production-ready MySQL instances that are configured with minimal surface for attackers. Furthermore it is intended to be compliant with the DevSec MySQL Baseline.

It configures:

  • Permissions for the various configuration files and folders
  • Removes anonymous users, root-users without a password and test databases
  • various hardening options inside MySQL

Requirements

  • Ansible 2.9.0
  • An existing MySQL installation

Example playbook

- hosts: localhost
  collections:
    - devsec.hardening
  roles:
    - mysql_hardening

This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:

  • mysql_hardening_enabled: yes role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"
  • mysql_hardening_user: 'mysql' The user that mysql runs as.
  • mysql_datadir: '/var/lib/mysql' The MySQL data directory
  • mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf' The path to the configuration file where the hardening will be performed

Role Variables

  • mysql_hardening_chroot
    • Default: ""
    • Description: chroot
  • mysql_hardening_options.safe-user-create
  • mysql_hardening_options.secure-auth
  • mysql_hardening_options.skip-symbolic-links
  • mysql_hardening_skip_grant_tables:
  • mysql_hardening_skip_show_database
  • mysql_hardening_options.local-infile
  • mysql_hardening_options.allow-suspicious-udfs
  • mysql_hardening_chroot.automatic-sp-privileges
  • mysql_hardening_options.secure-file-priv
  • mysql_allow_remote_root
    • Default: false
    • Description: delete remote root users
  • mysql_remove_anonymous_users
    • Default: true
    • Description: remove users without authentication
  • mysql_remove_test_database
    • Default: true
    • Description: remove test database
  • mysql_hardening_restart_mysql
    • Default: true
    • Description: Restart mysql after running this role

Further information is available at Deutsche Telekom (German) and Symantec