Skip to content

[Security] Add secure install and slow query log support#591

Open
alessekhjoy1824-automation wants to merge 5 commits intogeerlingguy:masterfrom
alessekhjoy1824-automation:feat/mysql-security-audit
Open

[Security] Add secure install and slow query log support#591
alessekhjoy1824-automation wants to merge 5 commits intogeerlingguy:masterfrom
alessekhjoy1824-automation:feat/mysql-security-audit

Conversation

@alessekhjoy1824-automation

This PR enhances MySQL security and introduces slow query log auditing capabilities for compliance, based on geerlingguy/ansible-role-mysql.

Security hardening items:

  • Disable remote root logins
  • Remove anonymous users
  • Remove default test database

Slow query log configuration logic:

  • Controlled via mysql_slow_query_log_enabled (default: false)
  • Generates /etc/mysql/conf.d/slow-query.cnf when enabled
  • slow_query_log is set to ON/OFF based on the variable
  • long_query_time defaults to 2 seconds but can be overridden via mysql_slow_query_time
  • Logs written to /var/log/mysql/slow.log with proper ownership

Compatibility:

  • New features are disabled by default and guarded behind boolean variables
  • No changes to handlers/, templates/, or vars/ directories

Validation steps:

  • Branch feat/mysql-security-audit contains all changes
  • Includes are added after configure and before other tasks
  • YAML files are linted for basic formatting

@alessekhjoy1824-automation
Copy link
Author

安全加固:该 PR 包含移除匿名用户、禁用远程 root 登录、删除测试数据库等措施,以提升 MySQL 默认安全性。

@alessekhjoy1824-automation
Copy link
Author

慢查询日志:该 PR 新增 slow query log 配置(默认关闭),可通过变量开启并设置 long_query_time,日志输出至 /var/log/mysql/slow.log。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant