Ensure SSL Key Files Have Appropriate Permissions

高等級 1自動化mysql

說明

When configured to use SSL/TLS, MySQL relies on Secure Sockets Layer (SSL) key files, which are stored on the host's filesystem. These SSL key files are subject to the host's permissions and ownership structure. Every file named by an ssl_ca/ssl_cert/ssl_key/ssl_crl variable must be -r-------- mysql:mysql (directories in ssl_capath/ssl_crlpath are skipped). Runs mysql -NBe with the client defaults: put an administrative account in ~/.my.cnf (mode 0600) or a mysql_config_editor login path, not MYSQL_PWD (see 1.4/1.6).

檢查方式

稽核方法: Shell 指令

shell

[ "$(id -u)" -eq 0 ] || exit 1; d=$(mysql -NBe "SELECT @@global.datadir" 2>/dev/null) || exit 1; l=$(mysql -NBe "SELECT VARIABLE_VALUE FROM performance_schema.global_variables WHERE LOWER(VARIABLE_NAME) REGEXP '^.*ssl_(ca|capath|cert|crl|crlpath|key)\$' AND VARIABLE_VALUE <> ''" 2>/dev/null) || exit 1; n=0; for f in $l; do case "$f" in /*) ;; *) f="$d/${f#./}" ;; esac; [ -f "$f" ] || continue; [ "$(stat -c '%a %U %G' "$f")" = "400 mysql mysql" ] || n=$((n+1)); done; [ "$n" -eq 0 ] && echo compliant || echo "$n noncompliant files"

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

chown mysql:mysql <ssl_file> && chmod 400 <ssl_file> for every ssl_ca/ssl_cert/ssl_key/ssl_crl file in use.

屬性

作業系統: 不限
標籤: mysqldatabasefilesystempermissionstls
參考資料: CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 3.7 Ensure SSL Key Files Have Appropriate Permissions

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target mysql