MySQL Security

MySQL Security

1. Backups - Database Security

   • Northgate Fire to Data Centre
   • Lost 24 hrs worth of data
   • make these available offsite

2. Restrict Physical Access to Data Centre

   • Use Microsoft Dublin as Example

3. Anti-Virus

   • Perform Full System Scans
     • at Suitable timing to prevent performance lag
   • exclusion and production load testing are important

4. Firewall

   • Keep as many ports controlled and closed as possible
   • TCP 3306 is port for MySQL
   • Secure Shell (SSH)
     • Crygwin
     • PUTTY
     • is a cryptographic network protocol for secure data communication, remote command-line login, remote command execution, and other secure network services between two networked computers. It connects, via a secure channel over an insecure network, a server and a client running SSH server and SSH client programs, respectively

5. Unwanted Services

   • This tool configures system services in connection with system runlevels. It turns on/off services using the scripts in /etc/init.d/. Rcconf works with System-V style runlevel configuration. It is a TUI(Text User Interface) frontend to the update-rc.d command.
   • these services can be used as side-door access
     • use windows services to prevent them from running

6. Patches

   • Apply Vendor updates - developers test patches before releasing or running live as this could cause big problems if not compatiable.

7. Sockets, Grants and Localhost

   • Restrict Remote Access
     • my.ini: skip-networking (allows local connections)
     • Windows "/etc/my.cnf" or "/etc/mysql/my.cnf" on Linux
   • Force sql to listen only to localhost bind-address=127.0.0.1
   • mysql> GRANT SELECT, INSERT ON mydb.* TO 'someuser'@'somehost';
   • Change root username and password
     • mysql> update user set user="new_user" where user="root"; mysql> flush privileges;
     • Password: mysql> SET PASSWORD FOR 'username'@'%hostname' = PASSWORD('newpass');

8. Disable LOCAL INFILE

   • Prevent access to local files, e.g. /etc/passwd/ Stops some SQL Injection attacks

9. Remove Test Database

   • DROP DATABASE test; Drop the test and any other unwanted DBs
     • Remove Test Accounts
       • SHOW GRANTS FOR ‘’@’locahost’; DROP USER “”;

10. Lower Access Priveledges

    • Set ownership to MySQL user: shell>ls -l /var/lib/mysql Only allow MySQL and root access: shell>ls -l /usr/bin/my Version 5 and above has preset restrictions!

11. Change root Directory

    • /chroot/mysql socket = /chroot/mysql/tmp/mysql.sock
    • download winjail