Google Cloud SQL
      Back to home
      1. CNS Policies
      2. GCP Knowledge Base
      3. Google Cloud SQL

      Root Password Not Set For MySQL Instances

      Ensures that the root user has a password set for all MySQL instances. 

      Risk Level: Medium

      Description

      This plugin ensures that the root user on the SQL instance has a password set to not allow anyone to directly connect with admin privileges. Without a password, unauthorized users can access the SQL instance. In order to ensure that the best security practices are being followed, PingSafe strongly recommends setting a password for the root user.

      About the Service

      Google Cloud SQL:

      Google Cloud SQL is a relational database for MySQL, PostgreSQL, and SQL Server that is fully managed. It automates database provisioning, storage capacity management, replication, and backups while lowering maintenance costs. It can be set up easily using the built-in migration tools and lets you scale your instances effortlessly. To know more about Cloud SQL, read here. 

      Impact

      It is essential to set a password for the root user to ensure maximum security. If no password is set, anyone can access the SQL instance and perform operations. As a result, attackers will have an easier time getting into your databases, potentially exposing your data to leaks and loss. Thus, the data's security and privacy are jeopardized.

      Steps to Reproduce

      Note: You can check if the root user does not have a password set only through the GCP Command Line Interface (CLI). Therefore, ensure that you have enabled the GKE API and have Cloud SDK installed. In case you do not have Cloud SDK installed, check out the link here to install it.

      Using GCP CLI-

      1. Using your account credentials, configure the GCP CLI if you haven’t already.
      2. Set up your glcoud command-line tool settings by using gcloud init command or gcloud config command.
      3. Run the following command to list the details of all projects in your GCP account.
        gcloud projects list
      4. Run the following command to list the details of all SQL instances in the selected project.
        gcloud sql instances list
      5. To check if your SQL instance does not have a root password set, run the following command:
        mysql -u root -h <instance-ip-address>
      6. If the command does not return the “Access denied” error as the output but instead lets you access the SQL instance, then there is no password set for the root user.
      7. Repeat steps 2 to 5 for all the SQL instances you want to investigate in the selected project.

      Steps for Remediation

      Make the necessary changes to set a password for the root user using the steps below.


      Using GCP Console-

      1. Log In to your GCP Console.
      2. From the top navigation bar, select the GCP project you want to investigate.
      3. From the navigation panel on the left side of the console, go to SQL. You can use this link here to navigate directly if you’re already logged in.
      4. Select the ID of the SQL instance you want to reconfigure from the list of instances available and click on the USERS tab. (In case you aren’t sure which SQL instance needs to be configured, follow the steps to reproduce listed above to determine which to choose.)

      5.  In the list of users displayed, click on the three-dot icon for the root username and select Change password.
      6. In the Change password for user root box, enter your desired password in the text box provided and click OK to apply the changes.
      7. Update all your database applications with the newly configured password for the root user.
      8. Repeat steps 4 to 7 for all the SQL instances you want to reconfigure in the selected project.
      9. If you have multiple projects, repeat steps 2 to 8 for each project in your GCP console.