This role provides security configurations for MySQL and its derivates. It is intended to set up production-ready MySQL instances that are configured with minimal surface for attackers. Furthermore it is intended to be compliant with the DevSec MySQL Baseline.
It configures:
- Permissions for the various configuration files and folders
- Removes anonymous users, users without a password or authentication_string and test databases
- various hardening options inside MySQL
- Ansible 2.9.0
- An existing MySQL installation
- hosts: localhost
collections:
- devsec.hardening
roles:
- mysql_hardening
This role expects an existing installation of MySQL or MariaDB. Please ensure that the following variables are set accordingly:
mysql_hardening_enabled: yes
role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example:mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"
mysql_hardening_user: 'mysql'
The user that mysql runs as.mysql_datadir: '/var/lib/mysql'
The MySQL data directorymysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'
The path to the configuration file where the hardening will be performed
mysql_hardening_chroot
- Default: ""
- Description: chroot
mysql_hardening_options.safe-user-create
- Default: 1
- Description: safe-user-create
mysql_hardening_options.secure-auth
- Default: 1
- Description: secure-auth
mysql_hardening_options.skip-symbolic-links
- Default: 1
- Description: skip-symbolic-links
mysql_hardening_skip_grant_tables:
- Default: false
- Description: skip-grant-tables
mysql_hardening_skip_show_database
- Default: 1
- Description: skip-show-database
mysql_hardening_options.local-infile
- Default: 0
- Description: local-infile
mysql_hardening_options.allow-suspicious-udfs
- Default: 0
- Description: allow-suspicious-udfs
mysql_hardening_chroot.automatic-sp-privileges
- Default: 0
- Description: automatic_sp_privileges
mysql_hardening_options.secure-file-priv
- Default: /tmp
- Description: secure-file-priv
mysql_allow_remote_root
- Default: false
- Description: delete remote root users
mysql_remove_anonymous_users
- Default: true
- Description: remove users without authentication
mysql_remove_test_database
- Default: true
- Description: remove test database
mysql_hardening_restart_mysql
- Default: true
- Description: Restart mysql after running this role
Further information is available at Deutsche Telekom (German) and Symantec