NixOS MySQL/Percona Server hardening: Enforce auth_socket for root user by default

Vulnerability Overview This vulnerability concerns the default insecure authentication configuration in MySQL/Percona Server. Specifically, by default, MySQL/Percona Server allows local root user authentication via the plugin, which could potentially allow local users to connect as the root user without providing correct credentials. Affected Scope MySQL/Percona Server: All instances of MySQL/Percona Server running with default configurations. NixOS: MySQL/Percona Server modules deployed on NixOS. Remediation 1. Enable the plugin: - Configure the setting - When this option is enabled, the module ensures that the user is authenticated via the plugin, preventing local users from connecting as root without proper credentials. 2. Update initial scripts: - When running the MySQL server for the first time, use the command to set the authentication method for the user. - If the configuration has been moved to a different location, no changes will be made. 3. Testing and Verification: - Add test case to verify that non-root users cannot connect as root, the system root can connect via socket, and the user has the plugin. - Add test case to verify that when is disabled, anyone can connect as root. POC Code The following are the relevant POC code blocks: Summary This vulnerability is mitigated by enabling the plugin and updating initial scripts, ensuring that the local root user can only be authenticated via the plugin, thereby enhancing security. Effectiveness of the fix is verified by adding test cases.

Goal Reached Thanks to every supporter — we hit 100%!

NixOS MySQL/Percona Server hardening: Enforce auth_socket for root user by default

More from this source