TMA-MYSQL-1.2
Use Dedicated Least Privileged Account for MySQL Daemon/Service
HighLevel 1Automatedmysql
Description
As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when the running mysqld process does not run as root (the benchmark expects the mysql account).
How it is checked
Audit method: Shell command
shell
out=$(ps -eo user:32=,comm= 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '$2=="mysqld"||$2=="mariadbd"{n++; if($1=="root")r++} END{if(!n)print "not-running"; else if(r)print "runs-as-root"; else print "compliant"}'- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run MySQL under a dedicated unprivileged account (normally mysql, no sudo rights, shell /bin/false): groupadd -r mysql; useradd -r -M -g mysql -d /var/lib/mysql -s /bin/false mysql; set user=mysql under [mysqld] or User=mysql in the systemd unit, then restart.
Properties
- Operating systems
- Any
- Tags
- mysqldatabaseserviceos
- Reference
- CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 1.2 Use Dedicated Least Privileged Account for MySQL Daemon/Service
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target mysql