Ensure 'super_priv' is Not Set to 'Y' for Replication Users

高等級 1自動化mysql

說明

The SUPER privilege found in the mysql.user table governs the use of a variety of MySQL features. These features include, CHANGE MASTER TO, KILL, mysqladmin kill option, PURGE BINARY LOGS, SET GLOBAL, mysqladmin debug option, logging control, and more. Treats every account other than root holding REPLICATION SLAVE as a replication user and counts those that also hold SUPER. Runs mysql -NBe with the client defaults: put an administrative account in ~/.my.cnf (mode 0600) or a mysql_config_editor login path, not MYSQL_PWD (see 1.4/1.6).

檢查方式

稽核方法: SQL 查詢

sql_query

out=$(mysql -NBe "SELECT COUNT(*) FROM mysql.user WHERE Repl_slave_priv = 'Y' AND Super_priv = 'Y' AND user NOT IN ('root')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

預期輸出: 0

修補方式

修補方法: 操作指南或基礎設施修補檔

REVOKE SUPER ON *.* FROM '<repl user>'@'<host>'; (grant REPLICATION_SLAVE_ADMIN instead if MySQL Shell ReplicaSet administration needs it).

屬性

作業系統: 不限
標籤: mysqldatabasereplicationauthorization
參考資料: CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 9.3 Ensure 'super_priv' is Not Set to 'Y' for Replication Users

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target mysql