Database Authentication Flag Should Be Disabled
More Info:
Ensure that the contained database authentication database flag for Cloud SQL on the SQL Server instance is set to off.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP, CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Database Authentication Flag Should Be Disabled” misconfiguration for GCP using GCP console, follow these steps:
- Open the Google Cloud Console and navigate to the Cloud SQL instances page.
- Select the instance you want to remediate.
- Click on the Edit button at the top of the page.
- Scroll down to the “Authorization” section.
- In the “Authorized networks” section, click on the “Add network” button.
- Add your IP address or the IP address range that should be authorized to access the instance.
- In the “Database flags” section, click on the “Add database flag” button.
- Add the flag “skip_grant_tables” and set its value to “on”.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the “Database Authentication Flag Should Be Disabled” misconfiguration in GCP using GCP CLI, you can follow the below steps:
- Open the Cloud Shell in your GCP console.
-
Run the following command to check the current status of the database authentication flag:
Replace [INSTANCE_NAME] with the name of your SQL instance.
- If the output of the above command contains “requireSsl: true”, it means that the database authentication flag is enabled and needs to be disabled.
-
Run the following command to disable the database authentication flag:
Replace [INSTANCE_NAME] with the name of your SQL instance.
-
Confirm the change by running the following command:
The output should be “False”, indicating that the database authentication flag has been successfully disabled.
-
Verify that the change has been applied by checking the authorized networks again:
The output should not contain “requireSsl: true” anymore.
Using Python
Using Python
To remediate the misconfiguration “Database Authentication Flag Should be Disabled” in GCP using python, follow the below steps:Step 1: Install the necessary librariesStep 2: Authenticate to GCPStep 3: Remediate the misconfigurationNote: This code assumes that the database authentication flag is stored in GCP Secret Manager. If the flag is stored elsewhere, such as in a configuration file or environment variable, the code will need to be modified accordingly.