Ensure No Anonymous Accounts Exist

HighLevel 1Automatedmariadb

Description

Anonymous accounts are users with empty usernames (''). Anonymous accounts have no passwords, so anyone can use them to connect to the MariaDB server. Runs mariadb -NBe with the client defaults: as root on the server the unix_socket plugin usually authenticates; otherwise put an administrative account in ~/.my.cnf (mode 0600), not MYSQL_PWD (see 1.4/1.6).

How it is checked

Audit method: SQL query

sql_query

out=$(mariadb -NBe "SELECT COUNT(*) FROM mysql.user WHERE user = ''" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Expected output: 0

How it is fixed

Fix method: Guidance or infrastructure patch

DROP USER ''@'<host>'; for each anonymous account (or run mariadb-secure-installation).

Properties

Operating systems: Any
Tags: mariadbdatabaseauthentication
Reference: CIS MariaDB 10.11 Benchmark v1.0.0 - 7.6 Ensure No Anonymous Accounts Exist

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target mariadb