andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for MariaDB Version when selecting users without passwords (#444)

Browse Source 
* added version check for MariaDB in Query

MariaDB Uses the authentication_string field since 10.4.0, added this in version check in query for users to delete

Signed-off-by: Martin Neubert <[email protected]>

* Update roles/mysql_hardening/tasks/mysql_secure_installation.yml

Co-authored-by: Sebastian Gumprich <[email protected]>

* Update roles/mysql_hardening/tasks/mysql_secure_installation.yml

Co-authored-by: Sebastian Gumprich <[email protected]>

Co-authored-by: Sebastian Gumprich <[email protected]>
This commit is contained in:
Martin NeubertandSebastian Gumprich authored and GitHub committed 2021-04-28 09:52:09 +02:00
1 parent 22f1802d97
commit 0324273dce
1 file changed
+6 -4
Download Patch File Download Diff File Expand all files Collapse all files
roles/mysql_hardening/tasks/mysql_secure_installation.yml
+6 -4
View File
@@ -46,7 +46,7 @@
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
when: mysql_remove_remote_root
- name: get all users that have no password or authentication_string on MySQL version >= 5.7.6
- name: get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
community.mysql.mysql_query:
query:
- SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -59,9 +59,10 @@
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
register: mysql_users_wo_passwords_or_auth_string
when:
- mysql_version.version.full is version('5.7.6', '>=')
- (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
(mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '>='))
- name: get all users that have no password on MySQL version < 5.7.6
- name: get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
community.mysql.mysql_query:
query:
- SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
@@ -76,7 +77,8 @@
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
register: mysql_users_wo_passwords
when:
- mysql_version.version.full is version('5.7.6', '<')
- (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
(mysql_distribution == "mariadb" and mysql_version.version.full is version('10.4.0', '<'))
- name: create a fact for users without password or authentication_string
set_fact: