Skip to content

Commit f295397

Browse files
rndmh3roSebastian Gumprich
rndmh3ro
and
Sebastian Gumprich
authored
add role argument spec for os, ssh, mysql (#687)
* add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * remove variable in variable as it cannot be used in argument spec Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * fix wrong syntax * fix spelling errors Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * cannot use vars before arg-spec validation Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * yamllint the arg-spec Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * add back variable Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * remove redundant setting in tests * fix descriptions in mysql hardening to betterreflect what they do Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * remove duplicate empty line Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * set correct defaults on to ssl options Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * remove left-over hidepid argument spec Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * remove license and author infos, this lives in the collection readme Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * fix styling Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * update some descriptions and sort them in the readme Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> * some more linting Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> --------- Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com> Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
1 parent 96ba9d1 commit f295397

File tree

14 files changed

+2942
-926
lines changed

14 files changed

+2942
-926
lines changed

‎molecule/ssh_hardening_custom_tests/converge.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,6 @@
2020
- path: "/etc/ssh/auth_principals/root"
2121
principals:
2222
- "root"
23-
owner: "{{ ssh_owner }}"
24-
group: "{{ ssh_group }}"
25-
directoryowner: "{{ ssh_owner }}"
26-
directorygroup: "{{ ssh_group }}"
27-
directorymode: "0700"
2823
network_ipv6_enable: true
2924
ssh_allow_tcp_forwarding: 'yes'
3025
ssh_gateway_ports: true

‎roles/mysql_hardening/README.md‎

Lines changed: 116 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# devsec.mysql_hardening
22

3-
![devsec.mysql_hardening](https://github.com/dev-sec/ansible-os-hardening/workflows/devsec.mysql_hardening/badge.svg)
3+
![devsec.mysql_hardening](https://github.com/dev-sec/ansible-collection-hardening/workflows/devsec.mysql_hardening/badge.svg)
44

55
## Description
66

@@ -12,74 +12,128 @@ It configures:
1212
- Removes anonymous users, users without a password or authentication_string and test databases
1313
- various hardening options inside MySQL
1414

15+
Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
16+
17+
Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
18+
1519
## Requirements
1620

17-
- Ansible 2.9.0
18-
- An existing MySQL installation
21+
- An existing installation of MySQL or MariaDB.
1922
- python-jmespath on the ansible host
2023

21-
### Example playbook
24+
<!-- BEGIN_ANSIBLE_DOCS -->
25+
## Supported Operating Systems
26+
| Platform | Versions |
27+
| -------- | -------- |
28+
| EL | 7, 8, 9 |
29+
| Ubuntu | bionic, focal, jammy |
30+
| Debian | bullseye, buster |
31+
| Amazon | |
32+
| opensuse | |
2233

23-
```yml
24-
- hosts: localhost
25-
collections:
26-
- devsec.hardening
27-
roles:
28-
- mysql_hardening
29-
```
34+
## Role Variables
3035

31-
This role expects an existing installation of MySQL or MariaDB. Changes of options `log_error` or `datadir` in `mysql_hardening_options` will not be checked for correct permissions. Please change/set `log_error` or `datadir` with the installation role of MySQL before running this role, or you can run this role twice.
32-
Please ensure that the following variables are set accordingly:
36+
* `mysql_daemon_enabled`
37+
* Default: `true`
38+
* Description: Whether to enable the MySQL-service so it starts on boot
39+
* Type: bool
40+
* Required: no
41+
* `mysql_hardening_chroot`
42+
* Default: ``
43+
* Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
44+
* Type: str
45+
* Required: no
46+
* `mysql_hardening_chroot.automatic-sp-privileges`
47+
* Default: `0`
48+
* Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
49+
* Type: int
50+
* Required: no
51+
* `mysql_hardening_enabled`
52+
* Default: `true`
53+
* Description: Whether to run the hardening
54+
* Type: bool
55+
* Required: no
56+
* `mysql_hardening_options.allow-suspicious-udfs`
57+
* Default: `0`
58+
* Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
59+
* Type: int
60+
* Required: no
61+
* `mysql_hardening_options.local-infile`
62+
* Default: `0`
63+
* Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
64+
* Type: int
65+
* Required: no
66+
* `mysql_hardening_options.safe-user-create`
67+
* Default: `1`
68+
* Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
69+
* Type: int
70+
* Required: no
71+
* `mysql_hardening_options.secure-auth`
72+
* Default: `1`
73+
* Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
74+
* Type: int
75+
* Required: no
76+
* `mysql_hardening_options.secure-file-priv`
77+
* Default: `/tmp`
78+
* Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
79+
* Type: str
80+
* Required: no
81+
* `mysql_hardening_options.skip-symbolic-links`
82+
* Default: `1`
83+
* Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
84+
* Type: int
85+
* Required: no
86+
* `mysql_hardening_restart_mysql`
87+
* Default: `true`
88+
* Description: Restart mysql after running this role
89+
* Type: bool
90+
* Required: no
91+
* `mysql_hardening_skip_grant_tables:`
92+
* Default: `false`
93+
* Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
94+
* Type: bool
95+
* Required: no
96+
* `mysql_hardening_skip_show_database`
97+
* Default: `1`
98+
* Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
99+
* Type: int
100+
* Required: no
101+
* `mysql_remove_anonymous_users`
102+
* Default: `true`
103+
* Description: Set to `false` to keep users without authentication
104+
* Type: bool
105+
* Required: no
106+
* `mysql_remove_remote_root`
107+
* Default: `true`
108+
* Description: If `true`, root can only connect from localhost. Set to `false` to not remove remote root users.
109+
* Type: bool
110+
* Required: no
111+
* `mysql_remove_test_database`
112+
* Default: `true`
113+
* Description: Set to `false` to keep the test database
114+
* Type: bool
115+
* Required: no
116+
* `mysql_root_password`
117+
* Default: `-----====>SetR00tPa$$wordH3r3!!!<====-----`
118+
* Description: The default password. Please change or overwrite it
119+
* Type: str
120+
* Required: no
121+
* `mysql_user_home`
122+
* Default: `{{ ansible_env.HOME }}`
123+
* Description: The path where the `.my.cnf` will be stored
124+
* Type: str
125+
* Required: no
33126

34-
- `mysql_hardening_enabled: yes` role is enabled by default and can be disabled without removing it from a playbook. You can use conditional variable, for example: `mysql_hardening_enabled: "{{ true if mysql_enabled else false }}"`
35-
- `mysql_hardening_user: 'mysql'` The user that mysql runs as.
36-
- `mysql_hardening_mysql_hardening_conf_file: '/etc/mysql/conf.d/hardening.cnf'` The path to the configuration file where the hardening will be performed
37-
- _deprecated: `mysql_datadir: '/var/lib/mysql'` The MySQL data directory_
38-
- `mysql_datadir` is no longer necessary, as MySQL data directory is automatically taken from `mysql_info`. But it can still be defined and will also be checked for correct permissions.
127+
## Dependencies
39128

40-
## Role Variables
129+
None.
41130

42-
- `mysql_hardening_chroot`
43-
- Default: ""
44-
- Description: [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
45-
- `mysql_hardening_options.safe-user-create`
46-
- Default: 1
47-
- Description: [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
48-
- `mysql_hardening_options.secure-auth`
49-
- Default: 1
50-
- Description: [secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)
51-
- `mysql_hardening_options.skip-symbolic-links`
52-
- Default: 1
53-
- Description: [skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)
54-
- `mysql_hardening_skip_grant_tables:`
55-
- Default: false
56-
- Description: [skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)
57-
- `mysql_hardening_skip_show_database`
58-
- Default: 1
59-
- Description: [skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)
60-
- `mysql_hardening_options.local-infile`
61-
- Default: 0
62-
- Description: [local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)
63-
- `mysql_hardening_options.allow-suspicious-udfs`
64-
- Default: 0
65-
- Description: [allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)
66-
- `mysql_hardening_chroot.automatic-sp-privileges`
67-
- Default: 0
68-
- Description: [automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)
69-
- `mysql_hardening_options.secure-file-priv`
70-
- Default: /tmp
71-
- Description: [secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)
72-
- `mysql_allow_remote_root`
73-
- Default: false
74-
- Description: delete remote root users
75-
- `mysql_remove_anonymous_users`
76-
- Default: true
77-
- Description: remove users without authentication
78-
- `mysql_remove_test_database`
79-
- Default: true
80-
- Description: remove test database
81-
- `mysql_hardening_restart_mysql`
82-
- Default: true
83-
- Description: Restart mysql after running this role
131+
## Example Playbook
132+
133+
```
134+
- hosts: all
135+
roles:
136+
- name: devsec.hardening.mysql_hardening
137+
```
138+
<!-- END_ANSIBLE_DOCS -->
84139

85-
Further information is available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)

‎roles/mysql_hardening/defaults/main.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ mysql_daemon_enabled: true
66

77
mysql_hardening_restart_mysql: true
88

9-
# general configuration
10-
mysql_hardening_mysql_hardening_conf_file: "{{ mysql_hardening_mysql_confd_dir }}/hardening.cnf"
119
# You have to change this to your own strong enough mysql root password
1210
mysql_root_password: "-----====>SetR00tPa$$wordH3r3!!!<====-----"
1311
# There .my.cnf with mysql root credentials will be installed

‎roles/mysql_hardening/meta/argument_specs.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
argument_specs:
3+
main:
4+
short_description: The main entry point for the mysql hardening role.
5+
version_added: 8.8.0
6+
options:
7+
mysql_hardening_chroot:
8+
default: ''
9+
type: str
10+
description: '[chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)'
11+
mysql_hardening_options.safe-user-create:
12+
default: 1
13+
type: int
14+
description: '[safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)'
15+
mysql_hardening_options.secure-auth:
16+
default: 1
17+
type: int
18+
description: '[secure-auth](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-auth)'
19+
mysql_hardening_options.skip-symbolic-links:
20+
default: 1
21+
type: int
22+
description: '[skip-symbolic-links](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_symbolic-links)'
23+
'mysql_hardening_skip_grant_tables:':
24+
default: false
25+
type: bool
26+
description: '[skip-grant-tables](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-grant-tables)'
27+
mysql_hardening_skip_show_database:
28+
default: 1
29+
type: int
30+
description: '[skip-show-database](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_skip-show-database)'
31+
mysql_hardening_options.local-infile:
32+
default: 0
33+
type: int
34+
description: '[local-infile](http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile)'
35+
mysql_hardening_options.allow-suspicious-udfs:
36+
default: 0
37+
type: int
38+
description: '[allow-suspicious-udfs](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_allow-suspicious-udfs)'
39+
mysql_hardening_chroot.automatic-sp-privileges:
40+
default: 0
41+
type: int
42+
description: '[automatic_sp_privileges](https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_automatic_sp_privileges)'
43+
mysql_hardening_options.secure-file-priv:
44+
default: /tmp
45+
type: str
46+
description: '[secure-file-priv](https://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_secure-file-priv)'
47+
mysql_remove_anonymous_users:
48+
default: true
49+
type: bool
50+
description: Set to `false` to keep users without authentication
51+
mysql_remove_test_database:
52+
default: true
53+
type: bool
54+
description: Set to `false` to keep the test database
55+
mysql_hardening_restart_mysql:
56+
default: true
57+
type: bool
58+
description: Restart mysql after running this role
59+
mysql_hardening_enabled:
60+
default: true
61+
type: bool
62+
description: Whether to run the hardening
63+
mysql_daemon_enabled:
64+
default: true
65+
type: bool
66+
description: Whether to enable the MySQL-service so it starts on boot
67+
mysql_root_password:
68+
default: '-----====>SetR00tPa$$wordH3r3!!!<====-----'
69+
type: str
70+
description: The default password. Please change or overwrite it
71+
mysql_user_home:
72+
default: '{{ ansible_env.HOME }}'
73+
type: str
74+
description: The path where the `.my.cnf` will be stored
75+
mysql_remove_remote_root:
76+
default: true
77+
type: bool
78+
description: If `true`, root can only connect from localhost. Set to `false`
79+
to not remove remote root users.

‎roles/mysql_hardening/tasks/configure.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
- name: Apply hardening configuration
5757
ansible.builtin.template:
5858
src: hardening.cnf.j2
59-
dest: "{{ mysql_hardening_mysql_hardening_conf_file }}"
59+
dest: "{{ mysql_hardening_mysql_confd_dir + '/hardening.cnf' }}"
6060
owner: "{{ mysql_cnf_owner }}"
6161
group: "{{ mysql_cnf_group }}"
6262
mode: "0640"

0 commit comments

Comments
 (0)