Default mysql shell /bin/sh is not compliant with CIS audit rule 5.2.4.7
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MySQL Router Charm |
In Progress
|
Medium
|
Adithya Rajendran |
Bug Description
When trying to harden a unit with mysql-router subordinate charm, the audit fails on rule `xccdf_
Indeed, the mysql user account has a /bin/sh shell associated. It should be /sbin/nologin for security standards.
Attached initial usg report.
- Version: 8.0.36
- Revision: 154
CIS documentation suggests the following script to check which user accounts need to be fixed:
```
#!/usr/bin/env bash
{
l_valid_
awk -v pat="$l_
}
```
Output is:
```
Service account: "mysql" has a valid shell: /bin/sh
```
Do we have a good reason to keep /bin/sh for mysql account that will maybe justify the rationale that breaks this rule ?
summary: |
- Default mysql login /bin/sh not compliant with hardening rule 5.2.4.7 + Default mysql shell /bin/sh is not compliant with hardening rule 5.2.4.7 |
summary: |
- Default mysql shell /bin/sh is not compliant with hardening rule 5.2.4.7 + Default mysql shell /bin/sh is not compliant with CIS audit rule 5.2.4.7 |
description: | updated |
tags: | added: good-first-bug |
Changed in charm-mysql-router: | |
assignee: | nobody → Adithya Rajendran (adithya-raj) |
Changed in charm-mysql-router: | |
status: | Triaged → In Progress |
Please could you add the version of the charm and the platform that it is being installed on? i.e. track/risk and machine Ubuntu version.
Thanks.