I managed to install Apache Mysql/Mariadb and PHP using playbook. How can I do mysql_secure_installation using ansible?

I am a beginner in Ansible. I want to set a new password to MySQL server and complete all security questions via playbook.

4 Answers 4


I implemented this myself for my MariaDB installations some time back, and before I trusted anyone else to do it correctly. These are the steps I performed:

  # mysql_secure_installation
- name: Update MariaDB root password
  mysql_user: name=root host={{item}} password={{mysql_root_password}}
    - ::1
    - localhost

- name: Set ~/.my.cnf file
  template: src=dotmy.cnf.j2 dest=/root/.my.cnf mode=0600

  # mysql_secure_installation
- name: Delete anonymous MySQL user
  mysql_user: name="" host={{item}} state=absent
    - localhost
    - "{{ansible_nodename}}"

  # mysql_secure_installation
- name: Delete Hostname based MySQL user
  mysql_user: name=root host="{{ansible_nodename}}" state=absent

  # mysql_secure_installation
- name: Remove MySQL test database
  mysql_db: name=test state=absent

You'll have to decide how to create mysql_root_password yourself.


I wrote a custom ansible module to do this: https://github.com/eslam-gomaa/mysql_secure_installation_Ansible .


- name: test mysql_secure_installation
    login_password: ''
    new_password: password22
    user: root
    login_host: localhost
    hosts: ['localhost', '', '::1']
    change_root_password: true
    remove_anonymous_user: true
    disallow_root_login_remotely: true
    remove_test_db: true
  register: mysql_secure
# To see detailed output
- debug:
    var: mysql_secure

You can do this with Ansible's Expect Module. Here is an example:

- name: secure mariadb
  become: yes
    command: mysql_secure_installation
      'Enter current password for root': ''
      'Set root password': 'n'
      'Remove anonymous users': 'y'
      'Disallow root login remotely': 'y'
      'Remove test database': 'y'
      'Reload privilege tables now': 'y'
    timeout: 1
  register: secure_mariadb
  failed_when: "'... Failed!' in secure_mariadb.stdout_lines"

Be aware: This configuration works for me but you may have to adjust the values according to your needs!


For idempotency reasons it is a good practice to implement the hardening steps done by mysql_secure_installation with dedicated Ansible tasks rather than executing mysql_secure_installation via Ansible directly.

mysql_secure_installation does the following:

  • set the root password
  • remove anonymous users
  • remove root remote access
  • remove the test database

Theses hardening tasks can be implemented with Ansible like this:

- name: test database is absent
  mysql_db: name=test state=absent
  when: mysql_remove_test_database

Check out dev-sec's MySQL hardening repository for an complete example how to implement the mysql_secure_installation steps with Ansible tasks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.