Each MySQL record identifies account login credentials, database information, and target hosts (IPs).
Did you know? You can allow the system to create MySQL authentication records for auto-discovered instances and scan them. This is supported for Unix installations only. To enable this feature, you must first create MySQL System Record Templates.
For the most current list of supported authentication technologies and the versions that have been certified for VM and PC by record type, please refer to the following article:
Authentication Technologies Matrix
|
Help me with the record settings |
|
How do I get started?How do I get started? - Go to Scans > Authentication. - Check that you already have a record defined for each host running database instances. - Create a MySQL record for the database instance. Go to New > Databases > MySQL. |
|
What do I enter in the User Name field?What do I enter in the User Name field? Enter the user name to be used for authentication to MySQL server. |
|
What do I enter in the Hosts field?What do I enter in the Hosts field? A list of FQDNs for the hosts that correspond to all host IP addresses on which a custom SSL certificate signed by a trusted root CA is installed. Multiple hosts are comma separated. |
|
Tell me about SSL verificationTell me about SSL verification Select to perform a complete SSL certificate validation. This option is only valid for servers that support SSL. - If unchecked (the default), Qualys scanners authenticate with MySQL servers that don't use SSL and MySQL servers that use SSL. However, in the SSL case, the server SSL certificate verification is skipped. - If checked, Qualys scanners will only send a login request after verifying that a connection to MySQL server uses SSL, the server SSL certificate is valid and matches the scanned host. |
|
Tell me about certificate authenticationTell me about certificate authentication Your server may require certificate authentication in order to establish an SSL connection. In this case, enter the client certificate (PEM-encoded X.509 certificate) and client key (PEM-encoded X.509 RSA private key). |
|
What database information is required?What database information is required? Tell us the database name to authenticate to and the port the database is running on. We provide default settings for both but these may be customized. Access to the MySQL configuration file is required to run certain checks. For authentication to Windows hosts, enter the Windows file. For authentication to Unix hosts, enter the Unix file. You may enter one or both. |
|
We support integration with multiple third party password vaults. Just go to Scans > Authentication > Vaults and tell us about your vault system. Then choose Authentication Vault in your record and select your vault name. At scan time, we'll authenticate to hosts using the account name in your record and the password we find in your vault. |
|
Which IPs should I add to my record?Which IPs should I add to my record? Select the IP addresses for the MySQL databases that the scanning engine should log into using the specified credentials. |
|
Important Notes for Unit ManagersImportant Notes for Unit Managers When a Unit Manager edits a record, the Unit Manager only sees the IPs in the record that they have permission to. Any changes made by the Unit Manager to the record settings will apply to all hosts defined in the record, regardless of whether all hosts belong to the user's business unit. The record may contain more IPs that are not visible to the Unit Manager. |
