baton-mysql

baton-mysql is a connector for MySQL 5.7 and 8.* built using the Baton SDK. It connects to your MySQL cluster and syncs privilege information about what access is granted to various users and roles.

Check out Baton to learn more about the project in general.

Getting Started

brew

brew install conductorone/baton/baton conductorone/baton/baton-mysql

baton-mysql --connection-string "baton:baton-password@tcp(127.0.0.1:3306)/"
baton resources

docker

docker run --rm -v $(pwd):/out public.ecr.aws/conductorone/baton-mysql:latest -f "/out/sync.c1z" --connection-string "baton:baton-password@tcp(127.0.0.1:3306)/"
docker run --rm -v $(pwd):/out ghcr.io/conductorone/baton:latest -f "/out/sync.c1z" resources

source

go install github.com/conductorone/baton/cmd/baton@main
go install github.com/conductorone/baton-mysql/cmd/baton-mysql@main

baton-mysql --connection-string "baton:baton-password@tcp(127.0.0.1:3306)/"
baton resources

Data Model

baton-mysql will sync information about the following MySQL resources:

• Uses
• Roles
• Servers
• Routines
• Tables
• Columns
• Databases

By default, the connector will introspect all databases that it has access to read. While some of these databases are informational, write access to mysql means that users can grant their own access, so it is important to include in reviews. You can use the --skip-database flag or the BATON_SKIP_DATABASE environment variable to exclude specific databases from being synced. The following internal databases are included by default:

• performance_schema
• information_schema
• mysql
• sys

Advanced Setup

1. Create a new user for the connector to connect to MySQL as. Be sure to create and save the secure password for this user:

CREATE USER conductorone IDENTIFIED BY 'secure-password';

2. Grant your new role the privileges required by the connector for inspecting privileges. MySQL 5.7:

GRANT SELECT (Host, User, Db, Select_priv, Insert_priv, Update_priv,  Delete_priv, Create_priv, Drop_priv,
              Grant_priv, References_priv, Index_priv, Alter_priv, Create_tmp_table_priv, Lock_tables_priv,
              Execute_priv, Create_view_priv, Show_view_priv, Create_routine_priv,
              Alter_routine_priv, Event_priv, Trigger_priv) ON mysql.db TO conductorone;
GRANT SELECT (Host, User, Db, Table_priv, Table_name) ON mysql.tables_priv TO conductorone;
GRANT SELECT (Host, User, Db, Column_name, Column_priv, Table_name) ON mysql.columns_priv TO conductorone;
GRANT SELECT (Host, User, Select_priv, Insert_priv, Update_priv,  Delete_priv, Create_priv, Drop_priv, Reload_priv,
              Shutdown_priv, Process_priv,
              References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv,
              Execute_priv, Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv, Create_routine_priv,
              Alter_routine_priv, Create_user_priv, Event_priv, Trigger_priv, Create_tablespace_priv,
              File_priv, Grant_priv, authentication_string) ON mysql.user TO conductorone;

MySQL 8+:

GRANT SELECT (USER, HOST, PRIV, WITH_GRANT_OPTION) ON mysql.global_grants TO conductorone;
GRANT SELECT (Host, User, Db, Select_priv, Insert_priv, Update_priv,  Delete_priv, Create_priv, Drop_priv,
              Grant_priv, References_priv, Index_priv, Alter_priv, Create_tmp_table_priv, Lock_tables_priv,
              Execute_priv, Create_view_priv, Show_view_priv, Create_routine_priv,
              Alter_routine_priv, Event_priv, Trigger_priv) ON mysql.db TO conductorone;
GRANT SELECT (Host, User, Db, Table_priv, Table_name) ON mysql.tables_priv TO conductorone;
GRANT SELECT (Host, User, Db, Column_name, Column_priv, Table_name) ON mysql.columns_priv TO conductorone;
GRANT SELECT (Host, User, Select_priv, Insert_priv, Update_priv,  Delete_priv, Create_priv, Drop_priv, Reload_priv,
              Shutdown_priv, Process_priv,
              References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv,
              Execute_priv, Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv, Create_routine_priv,
              Alter_routine_priv, Create_user_priv, Event_priv, Trigger_priv, Create_tablespace_priv, Create_role_priv,
              Drop_role_priv, File_priv, Grant_priv, authentication_string) ON mysql.user TO conductorone;
GRANT SELECT (FROM_HOST, FROM_USER, TO_HOST, TO_USER, WITH_ADMIN_OPTION) ON mysql.role_edges TO conductorone;

3. Grant your new user SELECT on each of the databases that you would like the connector to scan. In all likelihood, you will want this to be all databases. The connector does not look at any data within the databases, but SELECT is required in order to introspect the various schemas.

GRANT SELECT ON *.* TO conductorone;

Provisioning

With --provisioning (or BATON_PROVISIONING=true), baton-mysql can:

• Grant and revoke privileges on servers, databases, tables, columns (with --expand-columns) and routines, and role memberships and proxy access on MySQL 8+.
• Create and delete users. The connector generates a random password for each new user and escapes it according to the server's sql_mode.

Provisioning needs write privileges on top of the read access above: CREATE USER to create and delete users, each privilege to be granted held WITH GRANT OPTION at the same scope, ROLE_ADMIN for role memberships on MySQL 8+, and PROXY ... WITH GRANT OPTION on a role's account for proxy access to it. Scope the WITH GRANT OPTION grants to the databases ConductorOne manages; the example uses mydb.

GRANT CREATE USER ON *.* TO conductorone;
GRANT SELECT, INSERT ON mydb.* TO conductorone WITH GRANT OPTION;
GRANT ROLE_ADMIN ON *.* TO conductorone;
GRANT PROXY ON 'app_role'@'%' TO conductorone WITH GRANT OPTION;

The connector syncs, but does not provision, accounts whose user or host contains a character other than letters, digits, spaces and _ % . @ : / -, and the anonymous account (empty user name).

Contributing, Support and Issues

We started Baton because we were tired of taking screenshots and manually building spreadsheets. We welcome contributions, and ideas, no matter how small -- our goal is to make identity and permissions sprawl less painful for everyone. If you have questions, problems, or ideas: Please open a Github Issue!

See CONTRIBUTING.md for more details.

baton-mysql Command Line Usage

baton-mysql

Usage:
  baton-mysql [flags]
  baton-mysql [command]

Available Commands:
  capabilities       Get connector capabilities
  completion         Generate the autocompletion script for the specified shell
  help               Help about any command

Flags:
      --client-id string           The client ID used to authenticate with ConductorOne ($BATON_CLIENT_ID)
      --client-secret string       The client secret used to authenticate with ConductorOne ($BATON_CLIENT_SECRET)
      --collapse-users             Combine user@host pairs into a single user@[hosts...] identity $(BATON_COLLAPSE_USERS)
      --connection-string string   The connection string for connecting to MySQL ($BATON_CONNECTION_STRING)
      --expand-columns strings     Provide a table like db.table to expand the column privileges into their own entitlements. $(BATON_EXPAND_COLUMNS)
  -f, --file string                The path to the c1z file to sync with ($BATON_FILE) (default "sync.c1z")
  -h, --help                       help for baton-mysql
      --log-format string          The output format for logs: json, console ($BATON_LOG_FORMAT) (default "json")
      --log-level string           The log level: debug, info, warn, error ($BATON_LOG_LEVEL) (default "info")
  -p, --provisioning               This must be set in order for provisioning actions to be enabled. ($BATON_PROVISIONING)
      --skip-database strings      Skip syncing privileges from these databases ($BATON_SKIP_DATABASE)
  -v, --version                    version for baton-mysql

Use "baton-mysql [command] --help" for more information about a command.