Sebastian Gumprich
0bf528d83b
There's a new feature in mariadb 10.1 (https://mariadb.org/grant-to-public-in-mariadb/) and mysql 8 (need to verify). MariaDB has quite a complex privilege system. Most of it is based on the SQL Standard spec; however we do have some specific MariaDB extensions. GRANT ... TO PUBLIC (MDEV-5215) is a standard feature that is now available as a preview in MariaDB 10.11.0. It is related to ROLES and DEFAULT ROLE, but it covers a different use case. ROLES are effectively “privilege packages” that you can enable and disable as a user. One can also set which “privilege package” will be enabled at connect time by setting a DEFAULT ROLE per user. This is all quite useful, however it is missing one key feature. For a DBA, it would be quite useful to state only once that all users need to have a certain set of privileges. This is where GRANT ... TO PUBLIC comes in. Some more information here: https://mariadb.org/wp-content/uploads/2018/07/MariaDB-Roles-Tampere-Unconference-2018.pdf This role is shown as a user, it has however a new is_role-flag. MariaDB [(none)]> select user, host, is_role from mysql.user; +-----------------------+-----------+---------+ | User | Host | is_role | +-----------------------+-----------+---------+ | mariadb.sys | localhost | N | | root | localhost | N | | mysql | localhost | N | | PUBLIC | | Y | | monitoring | % | N | | monitoring | localhost | N | | galera_mariadb_backup | % | N | +-----------------------+-----------+---------+ Since this "user" does not have a password or authentication_string, the ansible-role tries to delete it but fails. Signed-off-by: Sebastian Gumprich <[email protected]>
97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
---
|
|
- name: Fail the role if the mysql root password was not set
|
|
ansible.builtin.fail:
|
|
msg: ERROR - you have to change default mysql_root_password
|
|
when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
|
|
|
|
- name: Ensure that the root password is present
|
|
community.mysql.mysql_user:
|
|
name: root
|
|
host_all: true
|
|
password: "{{ mysql_root_password | mandatory }}"
|
|
state: present
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
|
|
- name: Install .my.cnf with credentials
|
|
ansible.builtin.template:
|
|
src: my.cnf.j2
|
|
dest: "{{ mysql_user_home }}/.my.cnf"
|
|
mode: "0400"
|
|
tags: my_cnf
|
|
|
|
- name: Ensure that the test database is absent
|
|
community.mysql.mysql_db:
|
|
name: test
|
|
state: absent
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
when: mysql_remove_test_database
|
|
|
|
- name: Ensure that anonymous users are absent
|
|
community.mysql.mysql_user:
|
|
name: ""
|
|
state: absent
|
|
host_all: true
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
when: mysql_remove_anonymous_users
|
|
|
|
- name: Ensure that root can only login from localhost
|
|
community.mysql.mysql_query:
|
|
query: >
|
|
DELETE
|
|
FROM mysql.user
|
|
WHERE USER='root'
|
|
AND HOST NOT IN ('localhost',
|
|
'127.0.0.1',
|
|
'::1');
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
when: mysql_remove_remote_root
|
|
|
|
- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
|
|
community.mysql.mysql_query:
|
|
query: >
|
|
SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
|
|
FROM mysql.user
|
|
WHERE (length(authentication_string)=0
|
|
OR authentication_string="")
|
|
AND USER NOT IN ('mysql.sys',
|
|
'mysqlxsys',
|
|
'mariadb.sys')
|
|
AND IS_ROLE='N';
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
register: mysql_users_wo_passwords_or_auth_string
|
|
check_mode: false
|
|
when: >
|
|
(mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
|
|
(mysql_distribution == "mariadb" and mysql_version.version.full
|
|
is version('10.4.0', '>='))
|
|
|
|
- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
|
|
community.mysql.mysql_query:
|
|
query: >
|
|
SELECT CONCAT(QUOTE(USER), '@', QUOTE(HOST)) AS user
|
|
FROM mysql.user
|
|
WHERE (length(password)=0
|
|
OR password="")
|
|
AND (length(authentication_string)=0
|
|
OR authentication_string="")
|
|
AND USER NOT IN ('mysql.sys',
|
|
'mysqlxsys',
|
|
'mariadb.sys')
|
|
AND IS_ROLE='N';
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
register: mysql_users_wo_passwords
|
|
check_mode: false
|
|
when: >
|
|
(mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
|
|
(mysql_distribution == "mariadb" and mysql_version.version.full is
|
|
version('10.4.0', '<'))
|
|
|
|
- name: Ensure that there are no users without password or authentication_string
|
|
community.mysql.mysql_query:
|
|
query:
|
|
- DROP USER {{ item.user }}
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
with_community.general.flattened:
|
|
- "{{ mysql_users_wo_passwords.query_result | default([]) }}"
|
|
- "{{ mysql_users_wo_passwords_or_auth_string.query_result | default([]) }}"
|