TMA-MYSQL-1.2

Use Dedicated Least Privileged Account for MySQL Daemon/Service

높음레벨 1자동mysql

설명

As with any service installed on a host, it can be provided with its own user context. Providing a dedicated user to the service provides the ability to precisely constrain the service within the larger host context. Passes when the running mysqld process does not run as root (the benchmark expects the mysql account).

점검 방법

감사 방식: 셸 명령

shell

out=$(ps -eo user:32=,comm= 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '$2=="mysqld"||$2=="mariadbd"{n++; if($1=="root")r++} END{if(!n)print "not-running"; else if(r)print "runs-as-root"; else print "compliant"}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run MySQL under a dedicated unprivileged account (normally mysql, no sudo rights, shell /bin/false): groupadd -r mysql; useradd -r -M -g mysql -d /var/lib/mysql -s /bin/false mysql; set user=mysql under [mysqld] or User=mysql in the systemd unit, then restart.

속성

운영 체제: 모두
태그: mysqldatabaseserviceos
참고 자료: CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 1.2 Use Dedicated Least Privileged Account for MySQL Daemon/Service

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target mysql