TMA-MYSQL-7.2
Ensure Passwords are Not Stored in the Global Configuration
AltaNivel 1Automatizadamysql
Descripción
The [client] section of the MySQL configuration file allows setting a user and password to be used. Verify the password option is not used in the global configuration file (my.cnf). Reads the [client] groups of /etc/my.cnf and /etc/mysql/my.cnf (including !include files) with my_print_defaults; per-user ~/.my.cnf files are not global and are ignored.
Cómo se verifica
Método de auditoría: Comando de shell
shell
n=0; found=0; for c in /etc/my.cnf /etc/mysql/my.cnf; do [ -f "$c" ] || continue; found=1; o=$(my_print_defaults --defaults-file="$c" client 2>/dev/null) || exit 1; n=$((n + $(printf '%s\n' "$o" | grep -c '^--password'))); done; [ "$found" -eq 1 ] || exit 1; echo "$n"- Salida esperada
0
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Remove password= from the [client] section of the global option files; use mysql_config_editor (~/.mylogin.cnf) or a per-user ~/.my.cnf with mode 0600 instead.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- mysqldatabasecredentials
- Referencia
- CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 7.2 Ensure Passwords are Not Stored in the Global Configuration
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target mysql