From 10f5392d57107ebc70b75e40f97b54c34b5bfc78 Mon Sep 17 00:00:00 2001 From: Yavor Yanchev Date: Mon, 18 Jan 2016 17:51:22 +0200 Subject: [PATCH] Additional security for MySQL - it changes the default of sql_mode to include "NO_AUTO_CREATE_USER" - it will prevent the GRANT statement from automatically creating new user accounts unless authentication information is specified. --- .../org/apache/brooklyn/entity/database/mysql/mysql.conf | 4 ++++ .../apache/brooklyn/entity/database/mysql/mysql_master.conf | 4 ++++ .../apache/brooklyn/entity/database/mysql/mysql_slave.conf | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql.conf b/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql.conf index 85f55ab6ee..1583b73960 100644 --- a/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql.conf +++ b/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql.conf @@ -15,5 +15,9 @@ datadir = ${driver.dataDir} bind-address = 0.0.0.0 # skip-networking +#Prevent the GRANT statement from automatically creating new user accounts if it would otherwise do so, +#unless authentication information is specified +sql_mode = NO_AUTO_CREATE_USER + # Custom configuration options ${driver.mySqlServerOptionsString} \ No newline at end of file diff --git a/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_master.conf b/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_master.conf index 791f2da599..54a773be19 100644 --- a/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_master.conf +++ b/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_master.conf @@ -15,6 +15,10 @@ datadir = ${driver.dataDir} bind-address = 0.0.0.0 # skip-networking +#Prevent the GRANT statement from automatically creating new user accounts if it would otherwise do so, +#unless authentication information is specified +sql_mode = NO_AUTO_CREATE_USER + # Replication config server-id = 1 binlog-format = mixed diff --git a/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_slave.conf b/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_slave.conf index 1c6942386c..b4af02adb7 100644 --- a/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_slave.conf +++ b/brooklyn-library/software/database/src/main/resources/org/apache/brooklyn/entity/database/mysql/mysql_slave.conf @@ -16,6 +16,10 @@ datadir = ${driver.dataDir} bind-address = 0.0.0.0 # skip-networking +#Prevent the GRANT statement from automatically creating new user accounts if it would otherwise do so, +#unless authentication information is specified +sql_mode = NO_AUTO_CREATE_USER + # Replication config server-id = ${config["mysql.server_id"]} relay-log = mysql-slave-${config["mysql.server_id"]}-relay