Ensure Interactive Login is Disabled

MediumLevel 2Automatedmariadb

Description

When created, the MariaDB user may have interactive access to the operating system, which means that the MariaDB user could login to the host as any other user would. Checks that the mysql account has /bin/false or nologin as its shell.

How it is checked

Audit method: Shell command

shell

out=$(getent passwd mysql 2>/dev/null) || exit 1; s=${out##*:}; case "$s" in /bin/false|/usr/bin/false|/sbin/nologin|/usr/sbin/nologin) echo compliant ;; *) echo "$s" ;; esac

Expected output: compliant

How it is fixed

Fix method: Shell command

shell

usermod -s /bin/false mysql

Properties

Operating systems: Any
Tags: mariadbdatabaseosauthentication
Reference: CIS MariaDB 10.11 Benchmark v1.0.0 - 1.5 Ensure Interactive Login is Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target mariadb --level 2