MySQL
TMA-MYSQL-7.7
Ensure No Anonymous Accounts Exist
HighLevel 1Automatedmysql
Description
Anonymous accounts are users with empty usernames (''). Anonymous accounts have no passwords, so anyone can use them to connect to the MySQL server. Runs mysql -NBe with the client defaults: put an administrative account in ~/.my.cnf (mode 0600) or a mysql_config_editor login path, not MYSQL_PWD (see 1.4/1.6).
How it is checked
Audit method: SQL query
sql_query
out=$(mysql -NBe "SELECT COUNT(*) FROM mysql.user WHERE user = ''" 2>/dev/null) || exit 1; printf '%s\n' "$out"- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
DROP USER ''@'<host>'; for each anonymous account (or run mysql_secure_installation).
Properties
- Operating systems
- Any
- Tags
- mysqldatabaseauthentication
- Reference
- CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 7.7 Ensure No Anonymous Accounts Exist
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target mysql