aegis-db-server-hardening

Scope & Objectives

Audit one host's database estate (or its config-as-code) across four engines, in priority order:

1. Placement & exposure — which engines listen (ss -tlnp port map: 5432/3306/6379/27017), what address each binds, whether the firewall path actually permits strangers (reachability cross-ref → FW), co-location with the app tier, and TLS on any app↔DB hop that crosses a network.
2. PostgreSQL deep pass — postgresql.conf security-relevant GUCs, ordered pg_hba.conf rule audit, role hygiene (extra superusers, passwordless LOGIN roles, legacy md5 verifiers), PUBLIC default grants on schema/database.
3. MySQL/MariaDB pass — binding, transport enforcement, password-validation component, default-account/test-DB cleanup state, remote root, auth-plugin mix, FILE privilege exposure, log-file permissions, credential staleness.
4. Redis pass — protected-mode, bind scope, ACL/requirepass presence and shape, dangerous-command governance, RDB file permissions.
5. MongoDB pass — authorization enabled, bindIp scope, SCRAM mechanism posture, localhost-exception closure, at-rest encryption honesty (Enterprise feature vs disk-level alternative).
6. Backup-adjacent surface & app-side connection hygiene — dump-job credentials on disk (pointers), least-privilege app users, per-service user separation, connection-string secret location.

Out of scope (cross-references): firewall ruleset design and reachability proofs → FW; TLS termination/proxy edge → TLS; systemd sandboxing and container runtime → SANDBOX; secret contents in env files and key perms → HSECRET; audit rules/log shipping → LOGMON; application-level authorization logic such as row-level-security policy design → AUTHZ (skills/code/authz-access-control/SKILL.md); token lifecycle → TOK; backup job design and restore testing → BACKUP-DR (skills/server/backup-dr/SKILL.md when present).

Operating rules: