mysql--Database Security Configuration

1. Modify Root Permissions

Grant all privileges on *. * to ' root ' @ '% ' identified by ' root ' with grant option;--set specific host to have access privileges GRANT all privileges on * . * to ' root ' @ ' localhost ' identified by ' root ' with GRANT OPTION;

2. Check the account default password and weak password

Update user set Password=password (' Test!p3 ') where user= ' root ';

3. Delete or lock accounts that are not related to database operation, maintenance, etc.

--Delete the anonymous account delete from Mysql.user where user = ";D elete from mysql.db where user = ';

4. Users should be assigned account number to avoid sharing accounts between different users

--in the database permissions configuration capabilities, according to the user's business needs, configure their required minimum permissions grant all privileges on * * to [email  Protected] identified by ' Root '; GRANT all privileges the xxx.* to [email protected] identified by ' Root '; GRANT Select,insert,update,delete,create,drop on xxx.* to [email protected] identified by ' Root '; 
--reclaim unnecessary or dangerous authorizations to execute the REVOKE command: REVOKE all privileges on * * from ' root ' @ ' 192.168.120.11 '; 

GRANT and Revokeall privileges affect all permissions except with GRANT option alter affects the ability to create a stored routine by using the alter-table command routine effect created The use of the table command create routine affects the ability to change and discard stored routines create temporary tables affects the use of the Create temporary table command creating user impact creation, deprecation ; Ability to rename and revoke user permissions CREATE view affects the use of the CREATE VIEW command delete affects the use of the Delete command drop effect drop The use of the table command with execute affects the ability of a user to run a stored procedure event affects the ability to execute events (starting with MySQL5.1.6) file affects the use of grant for SELECT INTO outfile and load DATA infile option affects the ability of users to delegate permissions index affects the use of the CREATE INDEX and drop INDEX commands using the Insert effect of the Insert command using the Lock tables effect lock tables command using Process impact show The use of the processlist command references the placeholder for future MySQL features reload affect the use of the flush command set replication client affects the ability of users to query from server and home server locations replication Slave Copy the permissions required from the server select affects the use of the Select command show databases affects show databases command use Show view affects show CREATE The use of the view command shutdown affect the use of the Shutdown command super affects the use of administrator-level commands such as change, master, KILL thread, mysqladmin debug, PURGE Master logs, and set Globaltrigger affects the ability to execute triggers (starting from MySQL5.1.6) update affects usage usage of the update command only connection, not grant permission

--Re-read the authorization form. Otherwise, the change is not used until the server is restarted

FLUSH privileges;

--Check the database authorization status:

Use MySQL;

select * from user;

SELECT * from DB;

--select * from host;

SELECT * from Tables_priv;

SELECT * from Columns_priv;

5. Log Audits

/* Database should configure logging function

MySQL has the following types of logs:

Error log:-log-err

Query log:-log

Slow query log:-log-slow-queries

Update log:-log-update

Binary log:-log-bin

--In the MySQL installation directory, open the My.ini, after adding the above parameters, save and restart the MySQL service on the line. (Only the error log on the above, to open the other log to the front of the "#" removed)

#Enter a name for the binary log. Otherwise a default name would be used.

#log-bin= Mysql-bin

#Enter a name for the query log file. Otherwise a default name would be used.

#log =

#Enter a name for the error log file. Otherwise a default name would be used.

Log-error= "Win-zhijiatest.err"

#Enter a name for the update log file. Otherwise a default name would be used.

#log-update=

*/

--View all the log commands

Show variables like ' log_% ';

--View the specific log command

Show variables like ' Log_bin ';

6. Version View

SELECT VERSION ()

7. Connection Number Settings

/* Set the maximum minimum number of connections based on machine performance and business requirements. */

--Edit the MySQL configuration file: My.cnf or My.ini

max_connections = 1000

mysql--Database Security Configuration