mysql-hardening (Chef cookbook)

描述

为 mysql 提供安全配置。其目的是建立生产就绪的 mysql 实例，并配置最小的攻击面。

本 cookbook 专注于 mysql 的安全配置，并复用 mysql cookbook 进行安装。因此，你可以在 Chef 中现有的 mysql 配置之上添加此加固层。

我们优化了此 cookbook，使其能够与 os-hardening 和 ssh-hardening 无缝协作。即使不搭配使用也能正常运行，但你需要确保满足所有前置条件，例如 apt-get update 或 yum update。

要求

• Opscode chef

用法

一个示例 role 可能如下所示：

{
    "name": "mysql",
    "default_attributes": { },
    "override_attributes": { },
    "json_class": "Chef::Role",
    "description": "MySql Hardened Server Test Role",
    "chef_type": "role",
    "default_attributes" : {
      "mysql": {
        "server_root_password": "iloverandompasswordsbutthiswilldo",
        "server_debian_password": "iloverandompasswordsbutthiswilldo"
      }
    },
    "run_list": [
        "recipe[chef-solo-search]",
        "recipe[apt]",
        "recipe[mysql::server]",
        "recipe[mysql-hardening]"
    ]
}

Recipes

mysql-hardening::hardening (默认)

此 recipe 是 mysql cookbook 的覆盖 recipe，并应用 mysql-hardening::hardening

将以下内容添加到你的 runlist 中，并自定义安全选项属性

  "recipe[mysql::server]",
  "recipe[mysql-hardening]"

此加固 recipe 会安装加固配置，但期望已存在 Mysql、MariaDB 或 Percona 的安装。如果你未使用 mysql cookbook，可能需要调整以下属性：

• node['mysql']['service_name'] = 'default'
• node['mysql']['data_dir'] = '/var/lib/mysql'
• node['mysql-hardening']['conf-file'] = '/etc/mysql/conf.d/hardening.cnf'
• node['mysql-hardening']['user'] = 'mysql'

安全选项

更多信息已在 Deutsche Telekom（德语） 和 Symantec 上提供

• default['mysql']['security']['chroot'] - chroot
• default['mysql']['security']['safe_user_create'] - safe-user-create
• default['mysql']['security']['secure_auth'] - secure-auth
• default['mysql']['security']['skip_symbolic_links'] - skip-symbolic-links
• default['mysql']['security']['skip_show_database'] - skip-show-database
• default['mysql']['security']['local_infile'] - local-infile
• default['mysql']['security']['allow-suspicious-udfs'] - allow-suspicious-udfs
• default['mysql']['security']['automatic_sp_privileges'] - automatic_sp_privileges
• default['mysql']['security']['secure-file-priv'] - secure-file-priv

安全配置

此设置默认设置以下参数

user = mysql
port = 3306
bind-address = X.Y.Z.W

# via ['mysql']['security']['local_infile']
local-infile = 0

# via ['mysql']['security']['safe_user_create']
safe-user-create = 1

# via ['mysql']['security']['secure_auth']
secure-auth = 1

# via ['mysql']['security']['skip_show_database']
skip-show-database

# via ['mysql']['security']['skip_symbolic_links']
skip-symbolic-links

# via ['mysql']['security']['automatic_sp_privileges']
automatic_sp_privileges = 0

# via ['mysql']['security']['secure-file-priv']
secure-file-priv = /tmp

此外，它确保不设置以下参数

• 通过 ['mysql']['security']['secure_auth'] 停用 old-passwords
• 通过 node['mysql']['security']['allow-suspicious-udfs'] 停用 allow-suspicious-udfs
• skip-grant-tables
• chroot（对于 Ubuntu，我们更倾向于使用 AppArmor）

此外，/var/lib/mysql 的权限被限制为 mysql 用户。

测试

# Install dependencies
gem install bundler
bundle install

# Do lint checks
bundle exec rake lint

# Fetch tests
git clone https://github.com/dev-sec/tests-mysql-hardening test/integration

# fast test on one machine
bundle exec kitchen test default-ubuntu-1204

# test on all machines
bundle exec kitchen test

# for development
bundle exec kitchen create default-ubuntu-1204
bundle exec kitchen converge default-ubuntu-1204

此 cookbook 附带一个 guard 文件，便于开发。在开发过程中，guard 会监视文件夹并运行 footcritic 和 robocop。

# list all plugins
bundle exec guard list

# run guard with foodcritic and robocop
bundle exec guard -P Foodcritic Rubocop

已测试的操作系统

• Ubuntu 12.04
• Ubuntu 14.04
• CentOS 6.4
• CentOS 6.5
• Oracle 6.4
• Oracle 6.5
• Debian 7

贡献者 + 致谢

• Dominik Richter
• Christoph Hartmann
• Patrick Meier
• Edmund Haselwanter

许可证与作者

• Author:: Deutsche Telekom AG

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.