A few security configurations for MySQL

1, after the installation of MySQL to modify the root user password 5.5 before the RPM package installed after MySQL, the root user password is empty 5.6, RPM package after installing MySQL, will randomly generate a root password, saved in/root/.mysql_secret 5.7 to , random passwords are automatically generated by default when initialized with Mysqld--initialize, and do not create[email protected]Other accounts outside of   do not create test libraries;  2, properly licensed     mysql Library has 4 permission tables, user, DB, Tables_priv, Columns_priv, corresponding to the user password, user permissions to the database, permissions on the table, permissions on the column.      When a user initiates a request to MySQL, the host, user, password are first validated from the user table, followed by the DB, Tables_priv, Columns_priv, During the validation process, if the corresponding permission in the DB table is Y, the user's permissions on a library are all Y, and Tables_priv and Columns_priv are no longer validated.   for the security configuration related to account permissions in MySQL, summarize the following:     set up a separate account for each site      Create a separate database for each site      fine-grained permissions control in the order of User->db->tables_priv->columns_pri       individually configures a dedicated database for each user to ensure that all actions of the current user can only occur in its own database, preventing the hacker from accessing the system tables through injection points      if necessary, after SQL injection occurs. Change the root user name of MySQL (change in user table)  3, MySQL network fully configured      disable root user remote login      Firewall settings      Change the default port (default 3306) to prevent scanning of the port scan tool to some extent      limit the number of connections for a single user:         [mysqld]        max_user_ Connections 20 4, file permissions and file security    &nbspTo start the MySQL service with a non-root user      restrict the file permissions of the user who initiated the MySQL, while ensuring that the user has read and write access to the MySQL data file      You can use Chroot to change the root directory to prevent non-root users from accessing sensitive files, such as:/etc/passwd     do not grant process and super privileges to non-root users. The mysqladmin processlist and Show processlist commands view the commands that are executed by any user, which may be seen by other users update user set  Password= ...; Commands, super permissions can terminate sessions, change system parameters, and so on      do not use soft connections to tables (the--skip-symbolic-links parameter is used to disable this feature), and the table's soft connection is supported only by MyISAM. Since the table soft connection is turned on (especially if the MySQL service is started using the system root user), MySQL users can use mysqld to delete, rename files that are not in the same location as the data files      If the plugin folder can be mysql server written, then the user can use the select ... into dumpfile command to write executable code inside, you can by the Plugin_ The dir parameter corresponds to a path that is set to read-only and adjusts the--SECURE-FILE-PRIV parameter to improve security      do not grant file read and write permissions to non-root users, preventing the use of Load data  local infile to extract local files (such as extracting information from/etc/passwd, which can pose a threat to system security)          [Mysqld]        local-infile=0 5, if necessary, you can delete the ~/.bash_history file, Prevent read History command # rm .bash_histoRy .mysql_history# ln -s /dev/null .bash_history# ln -s /dev/null  .mysql_history  

A few security configurations for MySQL