ansible-collection-hardening/roles/mysql_hardening/tasks/mysql_secure_installation.yml

---
- name: Fail the role if the mysql root password was not set
  ansible.builtin.fail:
    msg: ERROR - you have to change default mysql_root_password
  when: mysql_root_password == '-----====>SetR00tPa$$wordH3r3!!!<====-----'

- name: Ensure that the root password is present
  community.mysql.mysql_user:
    name: root
    host_all: true
    password: "{{ mysql_root_password | mandatory }}"
    state: present
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"

- name: Install .my.cnf with credentials
  ansible.builtin.template:
    src: my.cnf.j2
    dest: "{{ mysql_user_home }}/.my.cnf"
    mode: "0400"
  tags: my_cnf

- name: Ensure that the test database is absent
  community.mysql.mysql_db:
    name: test
    state: absent
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_test_database

- name: Ensure that anonymous users are absent
  community.mysql.mysql_user:
    name: ""
    state: absent
    host_all: true
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_anonymous_users

- name: Ensure that root can only login from localhost
  community.mysql.mysql_query:
    query: >
      DELETE
      FROM mysql.user
      WHERE USER='root'
        AND HOST NOT IN ('localhost',
                         '127.0.0.1',
                         '::1');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when: mysql_remove_remote_root

- name: Get all users that have no authentication_string on MySQL version >= 5.7.6 or Mariadb version >= 10.4.0
  community.mysql.mysql_query:
    query: >
      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
      FROM mysql.user
      WHERE (length(authentication_string)=0
             OR authentication_string="")
        AND USER NOT IN ('mysql.sys',
                         'mysqlxsys',
                         'mariadb.sys');

    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords_or_auth_string
  when: >
    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '>=')) or
    (mysql_distribution == "mariadb" and mysql_version.version.full
    is version('10.4.0', '>='))

- name: Get all users that have no password or authentication_string on MySQL version < 5.7.6 or Mariadb version < 10.4.0
  community.mysql.mysql_query:
    query: >
      SELECT GROUP_CONCAT(QUOTE(USER), '@', QUOTE(HOST) SEPARATOR ', ') AS users
      FROM mysql.user
      WHERE (length(password)=0
             OR password="")
        AND (length(authentication_string)=0
             OR authentication_string="")
        AND USER NOT IN ('mysql.sys',
                         'mysqlxsys',
                         'mariadb.sys');
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_users_wo_passwords
  when: >
    (mysql_distribution == "mysql" and mysql_version.version.full is version('5.7.6', '<')) or
    (mysql_distribution == "mariadb" and mysql_version.version.full is
    version('10.4.0', '<'))

- name: Create a fact for users without password or authentication_string
  ansible.builtin.set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords_or_auth_string.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords_or_auth_string.query_result is defined
    - mysql_users_wo_passwords_or_auth_string.query_result != "" # noqa empty-string-compare

- name: Create a fact for users without password
  ansible.builtin.set_fact:
    users_wo_auth: "{{ mysql_users_wo_passwords.query_result.0.0 | community.general.json_query('users') }}"
  when:
    - mysql_users_wo_passwords.query_result is defined
    - mysql_users_wo_passwords.query_result != "" # noqa empty-string-compare

- name: Ensure that there are no users without password or authentication_string
  community.mysql.mysql_query:
    query:
      - DROP USER {{ users_wo_auth }}
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  when:
    - users_wo_auth is defined
    - users_wo_auth != "" # noqa empty-string-compare