In Part 1 of a two-part piece on Securing MySQL Thierry Manfe addresses the concern that should occur to every web project developer before opening the flood gates to on-line users. The article presents four steps that take the project development from the default configuration available on the developer's laptop to the level of security exposure on the web calls for.

The steps:

• 1: Set a password for the root account. "Root account" means, not the super-user of the operating system, but the super-user of MySQL itself. Code is supplied.

• 2: Remove all existing MySQL anonymous accounts- or assign a password to them - and the test database. The anonymous user has limited privileges and should be able to access the test database only. The test database could be filled with unnecessary data that would consume disk space, the article notes. Again, code is supplied.

-3: The article recommends using the mysql_secure_installation script, which does all of the above for you.

• 4: Users needing remote access to MySQL should, the paper continues, limit the remote access to a specific host, which can be done by assigning the IP address of the host to the bind-address option in the my.cnf file located in /etc/mysql. If you want to limit the access to the local host, set the skip-networking option in my.cnf

Part 2 of Manfe's article, MySQL in Production: Looking for Security, presents some best practices to secure MySQL in a production environment.

Manfe writes, "After setting a password for the MySQL root account and removing the test database and anonymous account you can also limit the remote access to MySQL to a specific host. You do this by setting the bind-address attribute in the /etc/mysql/my.cnf file to the host ip-address:

bind-address=ip-address

If you set bind-address to 127.0.0.1, which is the loopback address, then MySQL only accepts connections from the host where it runs.

"If you uncomment skip-networking in my.cnf," the writer continues, "MySQL only accepts connection from the Unix socket domain: the result is similar to setting bind-address ot 127.0.0.1: MySQL only accepts connection from the localhost. To limit damages that could be done to the system by hacking into MySQL, always run the mysqld daemon with a non-privileged user account. A good practice is to create a mysql Unix user dedicated to running mysqld."

Users desiring even more security can restrict access to the mysql.user table to the root user alone so that no one else can grant access to new users (as a reminder, only users listed in this table can actually connect to MySQL). Use "SELECT * FROM mysql.user" to obtain the list of MySQL users, and use "SHOW GRANTS [FOR user]" to see a user privileges, Manfe writes. As per data security, do not store plain-text passwords in the database. Use MD5(), SHA1() or some other one-way hashing function instead.

More Information

Some Guidelines on Managing Access to the Corporate IT Network

Download OpenSSO Express Build 8 [...read more...]

		fullsource
Print Email Current Profile Archive Blog Generate newsletter