Ensure Only Administrative Users Have Full Database Access

高等級 1人工審核mysql

說明

The mysql.user, mysql.db, and other mysql tables ending in _priv list a variety of privileges that can be granted (or denied) to MySQL users. Some of the privileges of concern include: Select_priv, Insert_priv, Update_priv, Delete_priv, Drop_priv, and so on.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Run SELECT * FROM information_schema.user_privileges WHERE grantee NOT LIKE ('\'mysql.%localhost\''); and ensure all returned users are administrative users with the minimal privileges required.

修補方式

修補方法: 操作指南或基礎設施修補檔

REVOKE unnecessary privileges (e.g. REVOKE ALL PRIVILEGES ON *.* FROM '<user>'@'<host>';) and GRANT only database-level privileges that are needed.

屬性

作業系統: 不限
標籤: mysqldatabaseauthorizationmanual
參考資料: CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 5.1 Ensure Only Administrative Users Have Full Database Access