search

OpenConext / OpenConext-deploy

Ansible-based deployment automation for the OpenConext platform
Apache License 2.0
12 stars 21 forks source link

Reduce privileges for backup- and SST-user #445

Closed tvdijen closed 8 months ago

tvdijen commented 9 months ago

https://mariadb.com/kb/en/mariabackup-sst-method/#authentication-and-privileges

Only a sub-set is required for SST to function

tvdijen commented 8 months ago

I just read that REPLICATION CLIENT has become a deprecated alias for BINLOG MONITOR in MariaDB 10.6, so depending on the version in use you may want to use the latter.

tvdijen commented 8 months ago

According to the documentation the backup-user should have the same privileges. I've verified this and backup remains in working condition. Could it be that the current privileges for the backup-user are there from the times we used Percona Xtrabackup instead of mariabackup?

tvdijen commented 8 months ago

May want to await https://jira.mariadb.org/browse/MDEV-33006 before merging, although everything seems to run smooth. I now have both the repl-user and the backup-user running with just the RELOAD, PROCESS, LOCK TABLES, BINLOG MONITOR privileges. Only thing I noticed is that mariabackup is complaining about a missing CONNECTION ADMIN privilege, which is why I opened the issue in their tracker.