Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

From Google Cloud CLI 1. List All SQL database instances of type MySQL: gcloud sql instances list --filter='DATABASE_VERSION:MYSQL*' --project <project_id> --format="(NAME,PRIMARY_ADDRESS)" 2. For every MySQL instance try to connect using the PRIMARY_ADDRESS, if available: mysql -u root -h <mysql_instance_ip_address> The command should return either an error message or a password prompt. Sample Error message: ERROR 1045 (28000): Access denied for user 'root'@'<Instance_IP>' (using password: NO) If a command produces the mysql> prompt, the MySQL instance allows anyone to connect with administrative privileges without needing a password. Note: The No Password setting is exposed only at the time of MySQL instance creation. Once the instance is created, the Google Cloud Platform Console does not expose the set to confirm whether a password for an administrative user is set to a MySQL instance.

조치 방법

조치 방식: 가이드 또는 인프라 패치

From Google Cloud Console 1. Go to the Cloud SQL Instances page in the Google Cloud Platform Console using https://console.cloud.google.com/sql/ 2. Select the instance to open its Overview page. 3. Select Access Control > Users. 4. Click the More actions icon for the user to be updated. 5. Select Change password, specify a New password, and click OK. From Google Cloud CLI 1. Set a password to a MySql instance: gcloud sql users set-password root --host=<host> --instance=<instance_name> - -prompt-for-password 2. A prompt will appear, requiring the user to enter a password: Instance Password: 3. With a successful password configured, the following message should be seen: Updating Cloud SQL user...done.