Learn Linux technology and teach you to play with MySQL

This is the next recommended step in installing the MySQL server for securing the database server. This script can help you improve the security of your MySQL server:

· If you did not set the password for the root account during installation, set it up immediately

· Disable remote root login by removing the root account that can be accessed from outside the local host

· Delete anonymous user accounts and test databases, and by default all users, even anonymous users, can access these accounts and test databases

Mysql_secure_installation

After running the above command, set the root password and rely on input [yes/y] and press [ENTER] to answer a series of questions.

2. Bind the database server to an Loopback address

This configuration restricts access from the remote machine, which tells the MySQL server to accept connections only from the local host. You can set it in the Master profile.

vi/etc/my.cnf [rhel/centos]vi/etc/mysql/my.conf [Debian/ubuntu]

OR

VI/ETC/MYSQL/MYSQL.CONF.D/MYSQLD.CNF [Debian/ubuntu]

Add the following line in the [mysqld] section

Bind-address = 127.0.0.1

3. Disable MySQL's LOCAL INFILE

As part of security enhancements, you need to disable Local_infile and use the following directives to prevent access to the underlying file system from MySQL in the [mysqld] section.

Local-infile=0

4. Modify the default port for MySQL

Set the port variable to listen for the MySQL port number of the TCP/IP connection. The default port number is 3306, but you can modify it in [mysqld].

port=5000

5. Enable MySQL Log

Logs are one way to understand what's going on during the service's run, and it's easy to see any intrusion-related behavior from the log when any attack occurs. You can turn on the MySQL log feature by adding the variables below to the [Mysqld] section of the configuration file.

Log=/var/log/mysql.log

6. Set the appropriate MySQL file access rights

Make sure that you have set the appropriate access permissions for all MySQL service files and data paths. File/etc/my.conf can only be modified by the root user, which prevents other users from modifying the configuration of the database service.

chmod 644/etc/my.cnf

7. Delete MySQL shell history

All commands you execute in the MySQL shell are saved by the MySQL client to a history file: ~/.mysql_history. This is dangerous, because for any user account you have created, all user names and passwords entered in the shell are recorded in the history file.

Cat/dev/null > ~/.mysql_history

8. Do not run the MySQL command on the command line

As you know, all the commands you enter on the terminal will be stored in a history file, depending on the shell you are using (for example, Bash's shell history file is placed in ~/.bash_history). An attacker who accesses this history file can easily see any passwords recorded there.

It is not recommended to enter a password on the command line as follows:

Mysql-u Root-ppassword_

IMG Connects MySQL with a password

When you look at the end of the command-line history file, you can see the previously entered password.

History

IMG View command Line input history

The recommended way to connect to MySQL is

Mysql-u root-p

Enter Password:

9. Define a database user for a specific app

For each app running on the server, set up only one database user associated with the app. For example, you have a WordPress website, create a wordpress database user as follows:

Mysql-u root-p

MariaDB [(None)]> CREATE DATABASE osclass_db;

MariaDB [(None)]> CREATE USER ' osclassdmin ' @ ' localhost ' identified by ' [email protected]%!2 ';

MariaDB [(None)]> GRANT all privileges on osclass_db.* to ' osclassdmin ' @ ' localhost ';

MariaDB [(None)]> FLUSH privileges;

MariaDB [(None)]> exit

And remember to delete the database users that are no longer in use.

10. Use additional security plugins and libraries

MySQL contains a number of security plug-ins: Authentication of requests from clients connecting to a MySQL server, secure storage of password checksums and sensitive information, all available in the free version.

? 11. Modify MySQL Password regularly

Regular password changes are a common information/application/system security recommendation. How often you change your password is determined by your internal security policy. Regular password changes can prevent long-term tracking of your "snoop", Get your password, log in to your MySQL server.

MariaDB [(none)]> use MySQL; MariaDB [(None)]> UPDATE user SET Password=password (' Yourpasswordhere ') WHERE user= ' root ' and Host = ' localhost '; MariaDB [(None)]> FLUSH privileges;

12. Update MySQL Server Packages regularly

It is strongly recommended that you periodically update the MYSQL/MARIADB package from the official warehouse to obtain new security updates and error improvements. Typically, the default package in the operating system is obsolete.

Yum updateapt Update

After making any modifications to the MYSQL/MARIADB server, restart the service.

Systemctl Restart mariadb #RHEL/centossystemctl restart MySQL #Debian/ubuntu

Learn Linux technology and teach you to play with MySQL