ansible-collection-hardening/roles/mysql_hardening
Sebastian Gumprich 6be31fbc3b
do not install mysql python package on target host (#401)
this package has to be installed on the host that executes the task

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
2021-02-10 15:57:51 +01:00
..
defaults add restart handler variable for mysql role (#399) 2021-02-10 15:54:57 +01:00
handlers add restart handler variable for mysql role (#399) 2021-02-10 15:54:57 +01:00
meta merge mysql-hardening role into collection 2020-11-07 21:48:10 +01:00
tasks do not install mysql python package on target host (#401) 2021-02-10 15:57:51 +01:00
templates add "role" to comment 2021-01-20 11:23:40 +01:00
vars do not install mysql python package on target host (#401) 2021-02-10 15:57:51 +01:00
CHANGELOG.md Prettified Code! 2020-11-08 10:20:25 +00:00
README.md add restart handler variable for mysql role (#399) 2021-02-10 15:54:57 +01:00

devsec.mysql_hardening

devsec.mysql_hardening

Description

This role provides security configurations for MySQL and its derivates. It is intended to set up production-ready MySQL instances that are configured with minimal surface for attackers. Furthermore it is intended to be compliant with the DevSec MySQL Baseline.

It configures:

  • Permissions for the various configuration files and folders
  • Removes anonymous users, root-users without a password and test databases
  • various hardening options inside MySQL

Requirements

  • Ansible 2.9.0
  • An existing MySQL installation

Example playbook

- hosts: localhost
  collections:
    - devsec.hardening
  roles:
    - devsec.hardening.mysql_hardening

This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:

  • mysql_hardening_enabled: yes role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"
  • mysql_hardening_user: 'mysql' The user that mysql runs as.
  • mysql_datadir: '/var/lib/mysql' The MySQL data directory
  • mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf' The path to the configuration file where the hardening will be performed

Role Variables

  • mysql_hardening_chroot
    • Default: ""
    • Description: chroot
  • mysql_hardening_options.safe-user-create
  • mysql_hardening_options.secure-auth
  • mysql_hardening_options.skip-symbolic-links
  • mysql_hardening_skip_grant_tables:
  • mysql_hardening_skip_show_database
  • mysql_hardening_options.local-infile
  • mysql_hardening_options.allow-suspicious-udfs
  • mysql_hardening_chroot.automatic-sp-privileges
  • mysql_hardening_options.secure-file-priv
  • mysql_allow_remote_root
    • Default: false
    • Description: delete remote root users
  • mysql_remove_anonymous_users
    • Default: true
    • Description: remove users without authentication
  • mysql_remove_test_database
    • Default: true
    • Description: remove test database
  • mysql_hardening_restart_mysql
    • Default: true
    • Description: Restart mysql after running this role

Further information is available at Deutsche Telekom (German) and Symantec