TMA-MARIADB-9.3

Ensure 'super_priv' is Not Set to 'Y' for Replication Users

높음레벨 1자동mariadb

설명

The SUPER privilege found in the mysql.user table governs the use of a variety of MariaDB features. These features include, CHANGE MASTER TO, KILL, mysqladmin kill option, PURGE BINARY LOGS, SET GLOBAL, mysqladmin debug option, logging control, and more. Treats every account other than root and mysql (the MariaDB system administrator accounts) holding REPLICATION SLAVE as a replication user and counts those that also hold SUPER. Runs mariadb -NBe with the client defaults: as root on the server the unix_socket plugin usually authenticates; otherwise put an administrative account in ~/.my.cnf (mode 0600), not MYSQL_PWD (see 1.4/1.6).

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(mariadb -NBe "SELECT COUNT(*) FROM mysql.user WHERE Repl_slave_priv = 'Y' AND Super_priv = 'Y' AND user NOT IN ('root', 'mysql')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: 0

조치 방법

조치 방식: 가이드 또는 인프라 패치

REVOKE SUPER ON *.* FROM '<repl user>'@'<host>';

속성

운영 체제: 모두
태그: mariadbdatabasereplicationauthorization
참고 자료: CIS MariaDB 10.11 Benchmark v1.0.0 - 9.3 Ensure 'super_priv' is Not Set to 'Y' for Replication Users

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mariadb