57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
---
|
|
- name: Protect my.cnf
|
|
file:
|
|
path: '{{ mysql_hardening_mysql_conf_file }}'
|
|
mode: '0640'
|
|
owner: '{{ mysql_cnf_owner }}'
|
|
group: '{{ mysql_cnf_group }}'
|
|
follow: true
|
|
state: file
|
|
|
|
- name: Ensure permissions on mysql-datadir are correct
|
|
file:
|
|
path: '{{ mysql_datadir }}'
|
|
state: directory
|
|
owner: '{{ mysql_hardening_user }}'
|
|
group: '{{ mysql_hardening_user }}'
|
|
mode: '0750'
|
|
|
|
- name: Ensure permissions on mysql-logfile are correct
|
|
file:
|
|
path: '{{ mysql_hardening_log_file }}'
|
|
state: file
|
|
owner: '{{ mysql_hardening_user }}'
|
|
group: '{{ mysql_hardening_group }}'
|
|
mode: '0640'
|
|
|
|
- name: Check mysql configuration-directory exists and has right permissions
|
|
file:
|
|
path: '{{ mysql_hardening_mysql_confd_dir }}'
|
|
state: directory
|
|
owner: '{{ mysql_hardening_user }}'
|
|
group: '{{ mysql_hardening_group }}'
|
|
mode: '0750'
|
|
|
|
- name: Check include-dir directive is present in my.cnf
|
|
lineinfile:
|
|
dest: '{{ mysql_hardening_mysql_conf_file }}'
|
|
line: '!includedir {{ mysql_hardening_mysql_confd_dir }}'
|
|
insertafter: 'EOF'
|
|
state: present
|
|
backup: true
|
|
notify: Restart mysql
|
|
|
|
- name: Apply hardening configuration
|
|
template:
|
|
src: 'hardening.cnf.j2'
|
|
dest: '{{ mysql_hardening_mysql_hardening_conf_file }}'
|
|
owner: '{{ mysql_cnf_owner }}'
|
|
group: '{{ mysql_cnf_group }}'
|
|
mode: '0640'
|
|
notify: Restart mysql
|
|
|
|
- name: Enable mysql
|
|
service:
|
|
name: '{{ mysql_daemon }}'
|
|
enabled: '{{ mysql_daemon_enabled }}'
|