Skip to content

[Security] Add secure install and slow query log support#592

Open
tousefanjrmc-ci wants to merge 1 commit intogeerlingguy:masterfrom
tousefanjrmc-ci:feat/mysql-security-audit
Open

[Security] Add secure install and slow query log support#592
tousefanjrmc-ci wants to merge 1 commit intogeerlingguy:masterfrom
tousefanjrmc-ci:feat/mysql-security-audit

Conversation

@tousefanjrmc-ci
Copy link

This PR enhances MySQL security hardening and introduces slow query log auditing for the role.

Security hardening items:

  • Disable remote root login (allow only localhost/127.0.0.1/::1).
  • Remove anonymous MySQL users.
  • Remove the default test database.
  • Flush privileges after changes.
  • New variable mysql_secure_installation (default: true) to gate execution of secure-install.yml.

Slow query log configuration logic:

  • New include task slow-query-log.yml is conditionally executed when mysql_slow_query_log_enabled is true (default: false).
  • Generates /etc/mysql/conf.d/slow-query.cnf with:
    • slow_query_log = ON/OFF based on mysql_slow_query_log_enabled.
    • long_query_time = mysql_slow_query_time (defaults to numeric 2 seconds if not defined).
    • slow_query_log_file = /var/log/mysql/slow.log.
  • Ensures /var/log/mysql directory exists and is owned by mysql with the correct group.

Compatibility notes:

  • Slow query log auditing is disabled by default; existing users are unaffected unless they enable mysql_slow_query_log_enabled.
  • Secure installation tasks are controlled via mysql_secure_installation (default: true) and are idempotent, ensuring baseline security without disrupting compliant systems.

Implementation details:

  • defaults/main.yml: added mysql_secure_installation (true) and set mysql_slow_query_time to numeric 2.
  • tasks/main.yml: added two conditional includes after Configure MySQL, before databases/users/replication tasks.
  • tasks/secure-install.yml: mysql_secure_installation equivalent tasks.
  • tasks/slow-query-log.yml: slow query log configuration and directory setup.

All new/updated YAML files pass basic yamllint (indentation and spacing).

@tousefanjrmc-ci
Copy link
Author

安全加固:在此 PR 中通过 secure-install.yml 执行删除匿名用户、禁用远程 root 登录、删除 test 数据库,并刷新权限,确保基础安全合规。

@tousefanjrmc-ci
Copy link
Author

慢查询日志:新增 slow-query-log.yml,动态生成 /etc/mysql/conf.d/slow-query.cnf,默认 long_query_time 为 2 秒,可通过变量覆盖,并确保日志目录和权限正确。

@tousefanjrmc-ci
Copy link
Author

安全加固:已实现禁用远程 root 登录、删除匿名用户、移除 test 数据库等基础安全加固措施。

@tousefanjrmc-ci
Copy link
Author

慢查询日志:新增 slow-query-log.yml,根据变量生成 /etc/mysql/conf.d/slow-query.cnf,默认 long_query_time 为 2 秒,可通过 mysql_slow_query_time 覆盖。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant