Skip to content
This repository has been archived by the owner on Nov 17, 2020. It is now read-only.

New role layout #8

Merged
merged 3 commits into from
Jan 19, 2016
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .kitchen.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ driver:
name: vagrant
provisioner:
name: ansible_playbook
test_repo_uri: https://github.com/TelekomLabs/tests-mysql-hardening.git
test_repo_uri: https://github.com/hardening-io/tests-mysql-hardening.git
hosts: all
require_ansible_repo: false
require_ansible_omnibus: true
Expand Down Expand Up @@ -46,9 +46,10 @@ platforms:
box_url: https://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_debian-8.1_chef-provisionerless.box
suites:
- name: default
roles_path: roles
hosts: all
ansible_verbose: true
ansible_version: 1.9.2
ansible_diff: true
roles_path: ../ansible-mysql-hardening/
provisioner:
playbook: test/integration/playbooks/default.yml
2 changes: 1 addition & 1 deletion .travis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ before_install:
install:
- pip install ansible
- echo -e 'localhost ansible_connection=local' > spec/inventory
- echo -e '[defaults]\nroles_path = ./roles\nhostfile = ./spec/inventory' > ansible.cfg
- echo -e '[defaults]\nroles_path = ../\nhostfile = ./spec/inventory' > ansible.cfg

script:
- ansible-playbook --syntax-check spec/travis.yml
Expand Down
19 changes: 10 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ This role focuses on security configuration of MySQL. Therefore you can add this

## Requirements

* Ansible
* Ansible

## Usage

Expand All @@ -20,7 +20,7 @@ Before you use this role make sure to have a valid login-configuration in `~/.my

- hosts: localhost
roles:
- ansible-os-hardening
- hardening.mysql-hardening

This hardening role installs the hardening but expects an existing installation of MySQL, MariaDB or Percona. Please ensure that the following variables are set accordingly:

Expand All @@ -30,7 +30,7 @@ This hardening role installs the hardening but expects an existing installation

## Security Options

Further information is already available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)
Further information is already available at [Deutsche Telekom (German)](http://www.telekom.com/static/-/155996/7/technische-sicherheitsanforderungen-si) and [Symantec](http://www.symantec.com/connect/articles/securing-mysql-step-step)

* `mysql_hardening_chroot` - [chroot](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_chroot)
* `mysql_hardening_options.safe-user-create` - [safe-user-create](http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_safe-user-create)
Expand All @@ -46,22 +46,22 @@ Further information is already available at [Deutsche Telekom (German)](http://w

This setup sets the following parameters by default

# via `mysql_hardening_options.local-infile`
# via `mysql_hardening_options.local-infile`
local-infile = 0

# via `mysql_hardening_options.safe-user-create`
# via `mysql_hardening_options.safe-user-create`
safe-user-create = 1

# via `mysql_hardening_options.safe-user-create`
# via `mysql_hardening_options.safe-user-create`
secure-auth = 1

# via `mysql_hardening_skip_show_database`
# via `mysql_hardening_skip_show_database`
skip-show-database

# via `mysql_hardening_options.skip-symbolic-links`
# via `mysql_hardening_options.skip-symbolic-links`
skip-symbolic-links

# via `mysql_hardening_chroot.automatic-sp-privileges`
# via `mysql_hardening_chroot.automatic-sp-privileges`
automatic_sp_privileges = 0

# via `mysql_hardening_options.secure-file-priv`
Expand Down Expand Up @@ -95,6 +95,7 @@ ansible-galaxy install -p roles/ bennojoy.mysql
# change password in MySQL-installation role to match the one from testing
sed -i 's/foobar/iloverandompasswordsbutthiswilldo/g' roles/bennojoy.mysql/defaults/main.yml


# fast test on one machine
bundle exec kitchen test default-ubuntu-1204

Expand Down