Files
ansible-collection-hardening/roles/mysql_hardening/tasks/mysql_secure_installation.yml
T
schurziandSebastian Gumprich a75e2c028b change inclusion of os specific defaults (#353)
* change inclusion of os specific defaults

we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)

Signed-off-by: Martin Schurz <[email protected]>

* simplify check for os specific variables

Signed-off-by: Martin Schurz <[email protected]>

* add test for variable override

Signed-off-by: Martin Schurz <[email protected]>

* move tests to verify stage

Signed-off-by: Martin Schurz <[email protected]>

* correct grep

Signed-off-by: Martin Schurz <[email protected]>

* linting

Signed-off-by: Martin Schurz <[email protected]>

* fix typo

Signed-off-by: Martin Schurz <[email protected]>

* Revert "Merge pull request #351 from sprat/fix-umask"

This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.

Signed-off-by: Martin Schurz <[email protected]>

* move immutable ssh vars to internal vars

Signed-off-by: Martin Schurz <[email protected]>

* move vars to OS files

Signed-off-by: Martin Schurz <[email protected]>

* change default handling for all roles

Signed-off-by: Martin Schurz <[email protected]>

* fix issues

Signed-off-by: Martin Schurz <[email protected]>

* add documentation

Signed-off-by: Martin Schurz <[email protected]>

* Update main.yml

Co-authored-by: Sebastian Gumprich <[email protected]>
2020-12-20 20:46:57 +01:00

47 lines
1.3 KiB
YAML

---
- name: Install mysqld python libary for Ansible
package:
name: '{{ mysql_python_package }}'
state: present
- debug:
msg: 'WARNING - you have to change default mysql_root_password'
when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
- name: root password is present
mysql_user:
name: 'root'
host_all: true
password: '{{ mysql_root_password | mandatory }}'
state: present
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
- name: install .my.cnf with credentials
template:
src: 'my.cnf.j2'
dest: '{{ mysql_user_home }}/.my.cnf'
mode: '0400'
tags: my_cnf
- name: test database is absent
mysql_db:
name: test
state: absent
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
when: mysql_remove_test_database
- name: anonymous users are absent
mysql_user:
name: ''
state: absent
host_all: true
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
when: mysql_remove_anonymous_users
- name: remove remote root
community.mysql.mysql_query:
query:
- DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1')
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
when: mysql_remove_remote_root