Permissions too restrictive on /etc/mysql/my.cnf #32
Conversation
users need to be able to read that file. We should set 0644 on /etc/mysql/my.cnf, but use 0400 on /etc/my.cnf and /root/.my.cnf because they contain passwords in plaintext.
| } | ||
| } | ||
| } | ||
| File { | ||
| owner => 'root', | ||
| group => 'root', | ||
| mode => '0400', |
There was a problem hiding this comment.
This is unnecessary. You should override the default on the one file you want to be different (/etc/mysql/my.cnf) so just set the mode on that one resource and leave the resource default.
There was a problem hiding this comment.
I think the 'default' is a matter of taste here. I see it as more of a "default is 644, but if there's passwords in the file, override the default and make the perms 400". Also, out of the box, the $etc_root_password variable won't be set, so you'll have one file 644, the other 400, making it a 50/50 split.
Certainly not anything I'll spend a lot of energy debating on though :) If after reading this you still would prefer it changed, just let me know and I'll fix it up.
I'm creating the issue on puppetlabs now.
There was a problem hiding this comment.
I'm fine with that, but I'd still prefer to have a file resource default. If we add another file resource I'd prefer to have some reasonable default mode. I guess the question is it better to be open by default or closed. Considering the importance of security in this module, I'd err on the side of being locked down by default.
|
Definitely file a bug. Set the category to mysql http://projects.puppetlabs.com/projects/modules/issues |
|
Bug filed at: http://projects.puppetlabs.com/issues/11720 |
…le permissions and using a default of 0400; overriding it to 0644 when needed.
|
@kbarber Can you give a thumbs up/down? |
|
👍 from me on this |
|
This change is in b1f90fd |
Delete broken line
Since /etc/mysql/my.cnf contains the [client] section, normal
users need to be able to read that file. We should set 0644
on /etc/mysql/my.cnf, but use 0400 on /etc/my.cnf and
/root/.my.cnf because they contain passwords in plaintext.
I gotta run, and won't be back until Tues Jan 3rd. Let me know if I need to file a bug report -- if anyone wants to save me the trouble, I'd appreciate it :)