A few suggestions for enhancing MYSQL safety

  • 2020-12-21 18:12:47
  • OfStack

Typically, we use a password when connecting to MySQL's server. This password is encrypted when transmitted over the network. But everything else is transmitted in plain text.

Of course, if you are worried about the security of this, you can use the compression protocol (MySQL3.22 and above), which can make other content not so easy to see. Even to make it more secure, consider installing ssh. Once installed, you can set up an encrypted TCP/IP connection between the MySQL server and the MySQL client.
To make your MySQL system more secure, it is highly recommended to consider the following tips:


1. Use password for each MySQL user. If you don't have a password, other people can access your database via mysql --user other_user database, and the system will warn you when using MySQL for detection.


2. Set up the mySQL authorization table with mysql_install_db script. You can test with ES29en-ES30en root. Change the password of root:
shell > mysql -u root mysql
mysql > UPDATE user SET Password=PASSWORD( ew_password)
WHERE user= root;
mysql > FLUSH PRIVILEGES;


3. Do not start the MySQL service with root. MySQL can be launched with any user. You can start the database service by adding a new user (that is, mysql runs with low permissions). This also doesn't have any impact on the system, because MySQL users and Unix users are fundamentally different.


4. If you put the Unix root user password in the ES61en.server script, make sure that the script is readable only for root. Check the user running mysqld to make sure that this user is the only one with read/write permissions in the database directory.


5. Don't give process permission to anyone. The output of mysqladmin processlist shows the body of the query being executed, and if another user issues an UPDATE user SET =PASSWORD(ot_secure) query, the query will be seen by the user with process permissions. mysqld reserves one additional connection for users with process permissions so that one MySQL root user can log in and check even if all normal connections are in use.


6. Do not give file permissions to all users. A user with this permission can write 1 file on the file system that has mysqld daemon permission! file permissions can also be used to read any file that is accessible to Unix users running the server. This can be exploited, for example, by using LOAD DATA to load "/etc/passwd" into a database table, which can then be read in using SELECT.


7. If you don't trust your DNS, you should use IP instead of the hostname. In any case, you should be very careful with host names that contain wildcards!
I believe that after the above Settings, your Mysql host should be relatively safe, not so easy to let people fall.


Related articles: