The security problem of MySQL database

The security of the database system includes many aspects. Because in many cases, the database server allows clients to connect from the network, the security of client connections has a significant impact on MySQL database security.

Do not provide a password on the client's command line

When using a client to connect to a MySQL server with MySQL, mysqladmin, and so on, you need to provide a password for the connection.

1, can provide the password on the command line

Shell>mysql–u Root–pmypass

Note that there is no space between the-p option and the password, or you will be prompted to enter the password, and error.

You can also use the long format

Shell>mysql–user=root–password=mypass

Now you can examine the consequences of doing this:

On Unix, $ps –aux | grep MySQL

On the Win9x, you can hold down the Ctrl+alt+del key, NT you can open Task Manager.

What you find, you find that the password is clearly displayed in front of you. So don't do it anytime.

So you need to have the client prompt for your password:

Shell>mysql–u root–p

You can also use the option file to provide a password, but note that in order to be secure, you cannot store the password in the options file. You can only provide the password option, let the client prompt you to enter the password.

Using SSH to encrypt client connections

This is a note about how to use SSH to get a secure connection to a remote MySQL server (David Carlson).

Install SSH clients on your Windows machine-I use a free SSH client from http://www.doc.ic.ac.uk/~ci2/ssh/. Other Useful Links:

Http://www.npaci.edu/Security/npaci_security_software.html

Http://www.npaci.edu/Security/samples/ssh32_windows/index.html.

Start SSH. Set host name = your MySQL server name or IP address, set userid= your username to login to your server.

Click on "Local Forwords". Set local port:3306, host:localhost, remote port:3306

Save everything, or you'll have to do it again next time.

Log in to your server with SSH.

Start some ODBC applications (for example, access).

Create a new file and link to MySQL with an ODBC driver, as you normally do, except for the server with the user "localhost".

Get. It works well for a direct Internet connection.

Do not run the MySQL daemon using the UNIX root user

Do not run the MySQL daemon as the root user of Unix. Mysqld can run with any user, you can also create a new UNIX user MySQL to make everything more secure. If you run mysqld as another UNIX user, you do not need to change the root username in the user table because the MySQL username is not the same as the UNIX user name.

You can edit Mysql.server startup script Mysqld as other UNIX users. Or use the option file. See chapter II for details on how to start a MySQL server with a non-root user.

Security of the database directory

MySQL server provides an authorization form through the MySQL database, and realizes a very flexible permission system, which guarantees the security of accessing data from the network. However, if other users on the server host have direct access to the server directory, the data for your server is still unsafe.

Generally you may use a non privileged UNIX user to execute the daemon. Check that the UNIX user running mysqld is the only user with read/write access under the database directory.

Possible security vulnerabilities

Obviously, you will not allow other users on the server host to have write access to the database directory files, but it is also very dangerous to read access only.

Because queries such as Grant and set password are logged to the log, the general and update log files contain sensitive query text about passwords. If an attack has read access to these logs, he can easily find the plaintext of the password by looking for sensitive words such as grant or password in the log file.

It is also dangerous to read access to table files, and it is trivial to steal files and make MySQL and display the contents of the table in plain text. You can do this by following these steps:

1. Install a new MySQL distribution, either on another host or on the current server host, using a different port, socket, and data file than the official server.

2, copy the stolen table files to the new service database directory in the test directory

3, then you can start the crime server, you can access the stolen table content.

Setting appropriate database directory permissions on Unix

If you want to eliminate these vulnerabilities, you need to schedule the database directory and all of its files and directories, and you can access them only with a dedicated account that starts the server. Action steps are as follows:

1, switch to root user

$su

2, set up the database directory and all of the file directory to run the account of the server all, in this book has been the account is assumed to be MySQL, all the group set as root group

%chown–r Mysql:root DataDir

3, modify the database directory and all of its file directory permissions for only the owner can read and write

%chmod–r go-rwx DataDir

Setting appropriate database directory permissions in NT systems

The security of a database directory in an NT system may be simpler:

Readers may think of changing all catalog files to only one account administrator, for example, to read and write. However, there is a problem, that is, this can be used in the Administrator account to manually start a separate server, if the MySQL system services to automatically start the method is not feasible, the solution is to make the database directory can also be read and written by the Administrators group of users, This way, the MySQL server can be started automatically with system services, or it can be started with net start MySQL in any account.

Another problem is that if you are in a administrators group of users or from the network can not establish a database connection, because there is no database directory to read the right to use, if you need to write the right. The solution is to allow system group users to read and write to the team database directory.

For licenses and fees, it is often recommended that you use MySQL on a Linux server for testing or data entry work on the Windows platform. However, if you want to use it on Windows, you can pay attention to some of the contents of this section.

MYSQLD options that affect security

The following mysqld options affect security:

--secure

The IP numbers returned by the gethostbyname () system call are checked to ensure they are parsed back to the original hostname. This makes it harder for some outsiders to get access rights by imitating other hosts. This option also adds some smart host name checks. In MySQL3.21, the default is turned off because it sometimes takes a long time to perform a reverse parsing. The MySQL 3.22 Cache host name and this option is enabled by default.

--skip-grant-tables

This option causes the server to not use the permissions system at all. This gives everyone the power to fully access all the databases! (by executing mysqladmin reload, you can tell a running server to start using the authorization table again.) )

--skip-name-resolve

The host name is not parsed. All the column values in the authorization table's host must be IP digits or localhost.

--skip-networking

TCP/IP connections are not allowed on the network. All connections to Mysqld must be made via UNIX sockets. This option is not appropriate for systems that use mit-pthreads because the Mit-pthreads package does not support UNIX sockets.

Note : For more wonderful tutorials, please pay attention to the triple graphics tutorial channel,