How to securely apply MySQL

How to securely apply MySQL PHPMA MySQL has become one of the most widely used databases on the network, especially for Web applications. It occupies the absolute advantage of Small and Medium applications. All of this comes from its small and easy-to-use, secure and effective, open license, and multi-platform. What's more, it works perfectly with PHP, one of the three major Web languages. PHPMA However, unfortunately, a default secure MySQL will be empty due to the root password andProgramThe vulnerability causes overflow, making the MySQL server frequently attacked. More seriously, the database is often damaged after being attacked, which may cause disastrous consequences. The following describes how to protect data. Environment requirements PHPMA 1. System Environment PHPMA Yes One Red Hat Linux 9.0. The GCC and some software packages, such as Apache and PHP, are installed on the customized server. The first thing after installing the system is to upgrade the system software package. As a Web Service The system accepts the PHP script request, and PHP uses the MySQL database to be installed as the Dynamic Release contact. The requirements for partitioning are similar to those for general systems. The only difference is that the/chroot and/tmp created later must be in the same partition. 2. Security Requirements PHPMA (1) MySQL runs in an independent (chroot) Environment; (2) The mysqld process runs in an independent user/user group. The user and user group have no root directory, shell, or other programs; (3) modify the root account of MySQL and use a complex password; (4) only allow local connection to MySQL. The network connection is disabled when MySQL is started; (5) Ensure that the nobody account used to connect to MySQL is disabled; (6) Delete the test database. Install MySQL 1. Installation preparation Before installing MySQL, create a user and group to start MySQL according to the preceding security requirements. # Groupadd MySQL # Useradd mysql-c "Start mysqld's account"-D/dev/null-G mysql-S/sbin/nologin 2. Compile and install Download MySQLSource codePackage: # Wget http://mysql.he.net/Downloads/MySQL...l-4.0.16.tar.gz Decompress: # Tar-zxvf mysql-4.0.16.tar.gz Generally, MySQL is installed in/usr/local/MySQL. you can adjust it if you have special requirements. However, this is of little significance, because chrooting will be used later, and then only the customer tools here will be used, such as MySQL, mysqladmin, and mysqldump. Compile and install the SDK. #./Configure -- prefix =/usr/local/MySQL \ -- With-mysqld-user = MySQL \ -- With-Unix-socket-Path =/tmp/MySQL. Sock \ -- With-mysqld-ldflags =-all-static # Make & make install # Strip/usr/local/MySQL/libexec/mysqld # Scripts/mysql_install_db # Chown-r root/usr/local/MySQL # Chown-r MySQL/usr/local/MySQL/var # Chgrp-r MySQL/usr/local/MySQL The specific functions of the above steps have been described in the MySQL manual. The only difference between the steps and general steps is -- With-mysqld-ldflags =-all-static. Because the chroot environment is required, Mysql itself does not need to create any database environments after it is connected to a static environment. 3. Configure and start MySQL configuration files must be manually selected and copied to/etc. These template files are located in the support-Files directory of the source file. There are four in total: small, medium, large, and huge. # Cp support-files/my-medium.cnf/etc/My. CNF # Chown root: SYS/etc/My. CNF # Chmod 644/etc/My. CNF Start mysql. Note that the user is MYSQL: #/Usr/local/mysq/bin/mysqld_safe -- user = MySQL & 4. Test To test whether the installed program is correct and whether MySQL has been started properly, the best way is to use the mysql client to connect to the database. #/Usr/local/MySQL/bin/MySQL [Root @ FTP bin] # MySQL Welcome to the MySQL monitor. commands end with; or \ G. Your MySQL connection ID is 687 to server version: 3.23.58 Type 'help; 'or' \ H' for help. Type '\ C' to clear the buffer. Mysql> Mysql> show databases; + -------------- + | Database | + -------------- + | MySQL | | Test | + -------------- + 2 rows in SET (0.00 Sec) Mysql> quit If the connection is successful, you can close the database: #/Usr/local/MySQL/bin/mysqladmin-uroot Shutdown If the connection fails, you need to carefully analyze the cause of the error: # More/usr/local/MySQL/var/'hostname'. Err Chrooting 1. chrooting Environment Chroot is a UNIX/Unix-like method. Its establishment will completely isolate it from the main system. That is to say, once a problem occurs, it will not endanger the running main system. This is a very effective method, especially when configuring network service programs. 2. chroot preparation First, we should establish a 1-display directory structure: # Mkdir-P/chroot/MySQL/dev # Mkdir-P/chroot/MySQL/etc # Mkdir-P/chroot/MySQL/tmp # Mkdir-P/chroot/MySQL/var/tmp # Mkdir-P/chroot/MySQL/usr/local/MySQL/libexec # Mkdir-P/chroot/MySQL/usr/local/MySQL/share/MySQL/English PHPMA Figure 1 directory structure Then set the directory permissions: # Chown-r root: SYS/chroot/MySQL # Chmod-r 755/chroot/MySQL # Chmod 1777/chroot/MySQL/tmp 3. Copy MySQL programs and files to the chroot directory. # Cp-P/usr/local/MySQL/libexec/mysqld/chroot/MySQL/usr/local/MySQL/libexec/ # Cp-P/usr/local/MySQL/share/MySQL/english/errmsg. sys /Chroot/MySQL/usr/local/MySQL/share/MySQL/english/ # Cp-P/etc/hosts/chroot/MySQL/etc/ # Cp-P/etc/host. CONF/chroot/MySQL/etc/ # Cp-P/etc/resolv. CONF/chroot/MySQL/etc/ # Cp-P/etc/group/chroot/MySQL/etc/ # Cp-P/etc/passwd/chroot/MySQL/etc/passwd # Cp-P/etc/My. CNF/chroot/MySQL/etc/PHPMA 4. Edit the passwd and group files under chroot. # Vi/chroot/etc/passwd PHPMA To open the passwd file, delete all rows except MySQL, root, and SYS. # Vi/chroot/etc/groupphpma To open the group file, delete all lines except MySQL and root. 5. Create a special device file/dev/null Just follow the system instructions: # Ls-Al/dev/null CrW-RW-1 Root 1, 3 Jan 30 2003/dev/null # Mknod/chroot/MySQL/dev/null C 1 3 # Chown root: Root/chroot/MySQL/dev/null # Chmod 666/chroot/MySQL/dev/nullphpma 6. Copy the MySQL database file to the chroot directory. # Cp-r/usr/local/MySQL/var // chroot/MySQL/usr/local/MySQL/var # Chown-r MYSQL: MySQL/chroot/MySQL/usr/local/MySQL/varphpma 7. Install the chrootuid Program Download the chrootuid and install it with RPM. Http://rpm.pbone.net/index.php3/sta...2.i586.rpm.html 8. Test MySQL configuration in the chroot environment # Chrootuid/chroot/MySQL/usr/local/MySQL/libexec/mysqld & PHPMA If the chroot directory fails, pay attention to the permission issues. 9. Test the connection to MySQL under chroot. #/Usr/local/MySQL/bin/MySQL -- socket =/chroot/MySQL/tmp/MySQL. Sock ....... Mysql> show databases; Mysql> Create Database wgh; Mysql> quit; # Ls-Al/chroot/MySQL/var/ ... PHPMA Configuration server To use MySQL more securely, You need to configure the security of the MySQL database. The configuration files are different for chroot reasons. 1. Disable remote connection First First, disable port 3306, which is the default listening port of MySQL. MySQL only serves local scripts, so remote connection is not required. Even though MySQL The built-in security mechanism is very strict, but listening to a TCP port is still dangerous, because if the MySQL program itself has problems, unauthorized access can completely bypass the Internal Security Server of MySQL. . The method for disabling network listening is very simple. In the [mysqld] section of the/chroot/MySQL/etc/My. CNF file, remove # Skip- "#" In front of networking. When the network is closed, how does a local program connect to the MySQL database? Local programs can be connected through mysql. Sock, which is faster than network connections. I will discuss the specific situation of MySQL. Sock later. MySQL backup is usually performed using SSH. 2. Prohibit MySQL from importing local files The following statement prohibits MySQL from using the "load data local infile" command. This command uses MySQL to read local files to the database, and then the user can obtain sensitive information illegally. To disable the preceding command, add the following statement to the [mysqld] section of the/chroot/MySQL/etc/My. CNF file: Set-variable = Local-infile = 0 PHPMA Is Management is convenient. MySQL management commands such as MySQL, mysqladmin, and mysqldump in the system are used by the system. /Etc/My. CNF file. If you want to connect to the MySQL server, it will find the/tmp/MySQL. Sock file to try to connect to the MySQL server. MySQL server. There are two solutions: one is to add -- socket =/chroot/MySQL/tmp/MySQL. Sock after the management command. For example: #/Usr/local/MySQL/bin/MySQL-root-p -- socket =/chroot/MySQL/tmp/MySQL. sockphpma Add socket =/chroot/MySQL/tmp/MySQL. Sock to the [client] section of/etc/My. CNF. Obviously, the second method is much more convenient. 3. Modify the root user ID and password of MySQL # Chrootuid/chroot/MySQL/usr/local/MySQL/libexec/mysqld & #/Usr/local/MySQL/bin/MySQL-uroot ....... Mysql> set password for root @ localhost = PASSWORD ('new _ password'); PHPMA Try to develop the habit of entering the password in MySQL, because it may be seen by others when entering the password in shell. Mysql> use MySQL; Mysql> Update user set user = "wghgreat" where user = "root "; Mysql> select host, user, password, select_priv, grant_priv from user; Mysql> Delete from user where user = ''; Mysql> Delete from user where Password = ''; Mysql> Delete from user where host = '% '; Mysql> drop database test; Change to an ID that is not easy to guess: Mysql> flush privileges; Mysql> quit; 4. Delete historical Command records These historical files include ~ /. Bash_history ,~ /. Mysql_history. If you open them, you will be surprised. How come there are some Plaintext Passwords here ?! # Cat/dev/null> ~ /. Bash_history # Cat/dev/null> ~ /. Mysql_history Communication between PHP and MySQL By default, PHP uses/tmp/MySQL. sock communicates with MySQL, but a major problem here is that MySQL does not generate it, but/chroot/MySQL/tmp/MySQL. sock. The solution is to establish a connection: # Ln/chroot/MySQL/tmp/MySQL. Sock/tmp/MySQL. Sock Note: Since hard links cannot be used between partitions in the file system, the connection must be in the same partition. Auto-start Configuration Note that a new account is required for the PHP database, and the database permission settings are available for the database, for example, file, Grant, acter, show database, reload, shutdown, process, and super. Example of self-starting script: #! /Bin/sh Chroot_mysql =/chroot/MySQL Socket =/tmp/MySQL. Sock Mysqld =/usr/local/MySQL/libexec/mysqld Pidfile =/usr/local/MySQL/var/'hostname'. PID Chrootuid =/usr/bin/chrootuid Echo-n "MySQL" Case "$1" in Start) Rm-RF $ {socket} Nohup $ {chrootuid }$ {chroot_mysql} MySQL $ {mysqld}>/dev/null 2> & 1 & Sleep 5 & ln $ {chroot_mysql}/$ {socket }$ {socket} ;; Stop) Kill 'cat $ {chroot_mysql}/$ {pidfile }' Rm-RF $ {chroot_mysql}/$ {socket} ;; *) Echo "" Echo "Usage: 'basename $ 0' {START | stop}"> & 2 Exit 64 ;; Esac Exit 0 PHPMA The file is located under/etc/rc. d/init. d and is named mysqld. Be sure to run it. # Chmod + x/etc/rc. d/init. d/mysqld # Ln-S/etc/rc. d/init. d/MySQL/etc/rc3.d/s90mysql # Ln-S/etc/rc. d/init. d/MySQL/etc/rc0.d/k20mysql Although we cannot achieve 100% of the security, these measures can protect our system more securely. P