alt version initial commit #15

fitz123 · 2016-05-21T10:49:29Z

No description provided.

fitz123 · 2016-05-21T10:51:19Z

defaults/main.yml

 mysql_datadir: '/var/lib/mysql'
 mysql_hardening_hardening_conf: '/etc/mysql/conf.d/hardening.cnf'
+mysql_root_password: "{{ lookup('env','mysql_root_password') }}"


I'm not sure about it, but don't know more secure way to pass values like that

We could use a separate variables-file that only contains the password and encrypt this file with vault. Or something along these lines.

fitz123 · 2016-05-21T11:01:35Z

Checks are failed because of "python-mysqldb" package installation and probably because of requirement of env variable

fitz123 · 2016-05-21T11:08:39Z

tasks/configure.yml

@@ -0,0 +1,18 @@
+---


everything here is copy-paste from old main.yml excluding last part with sql importing

rndmh3ro · 2016-05-21T13:07:16Z

Thanks for these improvements. I'll test them locally this weekend and see if anything fails.

fitz123 · 2016-05-21T13:18:41Z

I've tested it on one on my mariadb instances and at first view - it looks fine. Gonna test on galera cluster soon and fix if something will fail. So basically "mysql_secure_installation.yml" I've been used quite a long time already and never had issues with it, but "mysql_hardening_options" dict includes a lot of variables I've never used and not sure how it can affect servers, so gonna test them as well, but slowly

fitz123 · 2016-05-21T13:23:28Z

And it'd be great if you can find a way to fix travis checks)

rndmh3ro · 2016-05-21T13:26:31Z

And it'd be great if you can find a way to fix travis checks)

The problem is that the package-module is only supported from ansible 2.0 on. So we're going to have to stick to yum and apt tasks for now. See here: https://github.com/dev-sec/ansible-os-hardening/blob/master/tasks/pam.yml#L9-L15 on how to do it.

rndmh3ro · 2016-05-22T14:15:23Z

defaults/main.yml

@@ -1,4 +1,4 @@
-mysql_hardening_enabled: yes
+mysql_hardening_enabled: no


I think disabling the role by default is counter-intuitive.
If I would use this role, I'd expect that it would work out-of-the-box (like os and ssh hardening), not that I should still have to activate it. Because that's already what I'm doing when I'm including this role into one of my playbooks.

Up to you, but usually roles are deactivated by default to not accidentally fail builds. For os and ssh that's different, probably because you can successfully execute it on almost build, but mysql have to be executed on mysql-enabled instances only. My use case: I'm using 1 playbook for almost everything, and having group-specific variables that control which roles are enabled (except roles like os/ssh-hardening which can be safelly enabled for all (at least my) instances, so they're enabled by default, though it's an exclusion). We can do the opposite, if you still want. though I think it's better not to leave it disabled and force user to manually activate it

rndmh3ro · 2016-05-22T14:24:19Z

I don't understand the distinction between configure.yml and mysql_secure_installation.yml. Why are these both separated?

And why does mysql_secure_installation.yml only runs, when mysql_root_password != ''?
The secure installation should run even if the root-password is set. For example when some admin set a root-password but did not delete the test-database. Or when he forgot to remove the test users?

rndmh3ro · 2016-05-22T16:57:11Z

tasks/mysql_secure_installation.yml

+  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
+
+- name: Install python-mysqldb for Ansible
+  yum: name=python-mysqldb state=present


for rhel that's MySQL-python.

rndmh3ro · 2016-05-22T17:48:05Z

I tested the role successfully on a fresh centos 6.5 system and it works great!
I'm going to test it on ubuntu, debian and oracle systems next week.
If this is sucsessful and we can work on the remaining comments, this could be done by next week.

rndmh3ro · 2016-05-22T18:07:57Z

I'll update the travis file, too, because right now there isn't much testing going on at all.

fitz123 · 2016-05-22T18:10:52Z

Could you also test on ubuntu, as far as I know for apt module to work "python-apt" package is required. I have it installed in all templates since I start using ansible, so not super easy to test)

fitz123 · 2016-05-22T18:19:25Z

I don't understand the distinction between configure.yml and mysql_secure_installation.yml. Why are these both separated?

I separated them mostly logically/functionally, configure.yml responses for configuration hardening, and mysql_secure_installation.yml almost copies mysql-secure-installation script's functionality (https://dev.mysql.com/doc/refman/5.7/en/mysql-secure-installation.html)

And why does mysql_secure_installation.yml only runs, when mysql_root_password != ''?
The secure installation should run even if the root-password is set. For example when some admin set a root-password but did not delete the test-database. Or when he forgot to remove the test users?

It does (at least I guess it's) opposite, it doesn't run if you didn't pass root password as a parameter, because mysql_db module have to have credentials for "import" to work, ether passed as parameters or in .my.cnf.
But you have a point, if one doesn't want to set root password at all. So we need to have such an option into defaults, and check somehow if real root password is '', and user don't want to set it, just run the rest of tasks. Currently I'm assuming that setting root password is mandatory

rndmh3ro · 2016-05-29T10:56:19Z

defaults/main.yml

@@ -1,10 +1,13 @@
+mysql_hardening_enabled: no


We should set this to "yes", because my expectation is that a role just works when I include it into my playbook. Also I've never seen another role you have to "enable" with an additional variable.

rndmh3ro · 2016-05-29T11:04:27Z

Currently I'm assuming that setting root password is mandatory

Yes and we should force this, because if no password is set, than you have a huge gaping security hole, no matter if the installation is secured otherwise.

What I'd like to see:

make the role just work without having to set another variable
make the root password mandatory
please rebase against master
make a variable for mysql-user home, so the .my.cnf is in the correct location.

fitz123 · 2016-05-31T18:29:36Z

@rndmh3ro,
Sorry, but I not completely get the idea of 1st 2 points. It sounds controversial for me.
Currently I set default mysql root password and show notification during execution about it

I can change behaviour to ether:

do not set root password (comment variable out), make variable 'mandatory' and fail if variable is not defined. It means role will fail by default. Doesn't sound good
do not set root password and do not fail. Show notification about it, try run the rest of tasks without root password (probably user already has .my.cnf, or want to keep empty password). This is better way to go than previous approach, but I'd prefer to stick to current approach (setting default password) if there're no arguments against

…/root

…rmissions for users .my.cnf

fitz123 · 2016-06-05T07:03:07Z

any other comments?

rndmh3ro · 2016-06-05T19:50:52Z

Everything's fine now!
I'm in the process of testing the role right now, could take some time though.

rndmh3ro · 2016-06-10T20:15:10Z

So I tested the role:

There is a minor issue with RedHat that I will fix after merging this.
Also Oracle is a pain in the ass to test.

alt version initial commit

fitz123 reviewed May 21, 2016
View reviewed changes

rndmh3ro reviewed May 22, 2016
View reviewed changes

rndmh3ro reviewed May 29, 2016
View reviewed changes

fitz123 added 6 commits June 1, 2016 01:12

alt version initial commit

43b5e1e

remove .sql file

8986cd9

replace all mysql-client related tasks by ansible mysql modules tasks

2a8f03d

disable role by default

67a3b14

change default admin group mysql->root

57937c0

fixed package name for RHEL: python-mysqldb->MySQL-python

8882477

fitz123 added 5 commits June 1, 2016 01:38

add 'mysql_user_home' variable and turn on role by default

dfc4c81

install .my.cnf into 'mysql_user_home' location instead of hardcoded …

780c4af

…/root

make mysql_root_password as mandatory variable

9289dc8

make mysql_root_password mandatory variable and change owner/group pe…

01bd7bc

…rmissions for users .my.cnf

add warning about using default mysql_root_password

6542799

fitz123 force-pushed the alt_version branch from 01d890b to 6542799 Compare May 31, 2016 19:17

fitz123 added 5 commits June 1, 2016 02:20

add comments into defaults

f4e84e5

run mysql_secure_installation always

8f1d970

fix task name

4e4b931

README updated

56fe739

delete spaces in variables ({{ item }} -> {{item}})

ef77bf7

Update README with explaining of conditional enabling/disabling role

ec90b8d

rndmh3ro merged commit 6627aa6 into dev-sec:master Jun 10, 2016

rndmh3ro pushed a commit that referenced this pull request Jun 16, 2016

Merge pull request #15 from fitz123/alt_version

2932a4a

alt version initial commit

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

alt version initial commit #15

alt version initial commit #15

fitz123 commented May 21, 2016

fitz123 May 21, 2016

rndmh3ro May 21, 2016

fitz123 commented May 21, 2016

fitz123 May 21, 2016

rndmh3ro commented May 21, 2016

fitz123 commented May 21, 2016 •

edited

Loading

fitz123 commented May 21, 2016

rndmh3ro commented May 21, 2016

rndmh3ro May 22, 2016

fitz123 May 22, 2016

rndmh3ro commented May 22, 2016

rndmh3ro May 22, 2016

rndmh3ro commented May 22, 2016

rndmh3ro commented May 22, 2016

fitz123 commented May 22, 2016

fitz123 commented May 22, 2016 •

edited

Loading

rndmh3ro May 29, 2016

fitz123 May 31, 2016

rndmh3ro commented May 29, 2016 •

edited by fitz123

Loading

fitz123 commented May 31, 2016 •

edited

Loading

fitz123 commented Jun 5, 2016

rndmh3ro commented Jun 5, 2016

rndmh3ro commented Jun 10, 2016

		@@ -1,4 +1,4 @@
		mysql_hardening_enabled: yes
		mysql_hardening_enabled: no

alt version initial commit #15

alt version initial commit #15

Conversation

fitz123 commented May 21, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fitz123 commented May 21, 2016

Choose a reason for hiding this comment

rndmh3ro commented May 21, 2016

fitz123 commented May 21, 2016 • edited Loading

fitz123 commented May 21, 2016

rndmh3ro commented May 21, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rndmh3ro commented May 22, 2016

Choose a reason for hiding this comment

rndmh3ro commented May 22, 2016

rndmh3ro commented May 22, 2016

fitz123 commented May 22, 2016

fitz123 commented May 22, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rndmh3ro commented May 29, 2016 • edited by fitz123 Loading

fitz123 commented May 31, 2016 • edited Loading

fitz123 commented Jun 5, 2016

rndmh3ro commented Jun 5, 2016

rndmh3ro commented Jun 10, 2016

fitz123 commented May 21, 2016 •

edited

Loading

fitz123 commented May 22, 2016 •

edited

Loading

rndmh3ro commented May 29, 2016 •

edited by fitz123

Loading

fitz123 commented May 31, 2016 •

edited

Loading