103 lines
3.6 KiB
YAML
103 lines
3.6 KiB
YAML
---
|
|
- name: Fail the role if the mysql root password was not set
|
|
fail:
|
|
msg: 'ERROR - you have to change default mysql_root_password'
|
|
when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'
|
|
|
|
- name: ensure that the root password is present
|
|
mysql_user:
|
|
name: 'root'
|
|
host_all: true
|
|
password: '{{ mysql_root_password | mandatory }}'
|
|
state: present
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
|
|
- name: Install .my.cnf with credentials
|
|
template:
|
|
src: 'my.cnf.j2'
|
|
dest: '{{ mysql_user_home }}/.my.cnf'
|
|
mode: '0400'
|
|
tags: my_cnf
|
|
|
|
- name: ensure that the test database is absent
|
|
mysql_db:
|
|
name: test
|
|
state: absent
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
when: mysql_remove_test_database
|
|
|
|
- name: ensure that anonymous users are absent
|
|
mysql_user:
|
|
name: ''
|
|
state: absent
|
|
host_all: true
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
when: mysql_remove_anonymous_users
|
|
|
|
- name: ensure that root can only login from localhost
|
|
community.mysql.mysql_query:
|
|
query:
|
|
- DELETE
|
|
FROM mysql.user
|
|
WHERE USER='root'
|
|
AND HOST NOT IN ('localhost',
|
|
'127.0.0.1',
|
|
'::1')
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
when: mysql_remove_remote_root
|
|
|
|
- name: get all users that have no password or authentication_string on MySQL version >= 5.7.6
|
|
community.mysql.mysql_query:
|
|
query:
|
|
- SELECT GROUP_CONCAT(USER, '@', HOST SEPARATOR ', ') AS users
|
|
FROM mysql.user
|
|
WHERE (length(authentication_string)=0
|
|
OR authentication_string="")
|
|
AND USER NOT IN ('mysql.sys',
|
|
'mysqlxsys',
|
|
'mariadb.sys');
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
register: mysql_users_wo_passwords_or_auth_string
|
|
when:
|
|
- mysql_version.version.full is version('5.7.6', '>=')
|
|
|
|
- name: get all users that have no password on MySQL version < 5.7.6
|
|
community.mysql.mysql_query:
|
|
query:
|
|
- SELECT GROUP_CONCAT(USER, '@', HOST SEPARATOR ', ') AS users
|
|
FROM mysql.user
|
|
WHERE (length(password)=0
|
|
OR password="")
|
|
AND (length(authentication_string)=0
|
|
OR authentication_string="")
|
|
AND USER NOT IN ('mysql.sys',
|
|
'mysqlxsys',
|
|
'mariadb.sys');
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
register: mysql_users_wo_passwords
|
|
when:
|
|
- mysql_version.version.full is version('5.7.6', '<')
|
|
|
|
- name: create a fact for users without password or authentication_string
|
|
set_fact:
|
|
users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
|
|
when:
|
|
- mysql_users_wo_passwords_or_auth_string.query_result is defined
|
|
- mysql_users_wo_passwords_or_auth_string.query_result != "" # noqa empty-string-compare
|
|
|
|
- name: create a fact for users without password
|
|
set_fact:
|
|
users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
|
|
when:
|
|
- mysql_users_wo_passwords.query_result is defined
|
|
- mysql_users_wo_passwords.query_result != "" # noqa empty-string-compare
|
|
|
|
- name: ensure that there are no users without password or authentication_string
|
|
community.mysql.mysql_query:
|
|
query:
|
|
- "DROP USER {{ users_wo_auth }}"
|
|
login_unix_socket: "{{ login_unix_socket | default(omit) }}"
|
|
when:
|
|
- users_wo_auth is defined
|
|
- users_wo_auth != "" # noqa empty-string-compare
|