mysql添加mcafee 審計外掛程式

標籤：驗證   install   檔案   alt   files   foreign   recommend   roo   源碼   

外掛程式源碼地址
https://github.com/mcafee/mysql-audit
外掛程式安裝方法
https://github.com/mcafee/mysql-audit/wiki/Installation
外掛程式
https://bintray.com/mcafee/mysql-audit-plugin/release/1.0.9-585

1、查看mysql外掛程式存放目錄
mysql> SHOW GLOBAL VARIABLES LIKE ‘plugin_dir‘;
+---------------+-----------------------------------+
| Variable_name | Value |
+---------------+-----------------------------------+
| plugin_dir | /usr/local/mysql/lib/plugin/ |
+---------------+-----------------------------------+
1 row in set (0.01 sec)

2、複製libaudit_plugin.so 至 mysql外掛程式目錄
mv libaudit_plugin.so /usr/local/mysql/lib/plugin/
chmod a+x /usr/local/mysql/lib/plugin/*
chown mysql:mysql /usr/local/mysql/lib/plugin/*

3、安裝外掛程式
初使使用線上安裝，但是安裝失敗
mysql> INSTALL PLUGIN AUDIT SONAME ‘libaudit_plugin.so‘;
ERROR 1524 (HY000): Plugin ‘AUDIT‘ is not loaded

然後使用修改配置，然後重啟資料庫，官方推薦使用修改配置方式安裝。
Note: On production systems, McAfee recommends using the plugin-load option for installing the audit plugin.

修改my.cnf檔案，添加載入審計外掛程式代碼
plugin-load=AUDIT=libaudit_plugin.so
audit_json_file=on
audit_force_record_logins=on
audit_json_file_sync=1

重啟資料庫
/etc/init.d/mysql.server restart

4、查看外掛程式狀態
mysql> show plugins;
+----------------------------+----------+--------------------+--------------------+---------+
| Name | Status | Type | Library | License |
+----------------------------+----------+--------------------+--------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| mysql_old_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| sha256_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| FEDERATED | DISABLED | STORAGE ENGINE | NULL | GPL |
| PERFORMANCE_SCHEMA | ACTIVE | STORAGE ENGINE | NULL | GPL |
| BLACKHOLE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| InnoDB | ACTIVE | STORAGE ENGINE | NULL | GPL |
| INNODB_TRX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCKS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCK_WAITS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE_LRU | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_POOL_STATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_METRICS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DEFAULT_STOPWORD | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_BEING_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_CONFIG | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_CACHE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_TABLE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESTATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_INDEXES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_COLUMNS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FIELDS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN_COLS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESPACES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_DATAFILES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| ARCHIVE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| AUDIT | ACTIVE | AUDIT | libaudit_plugin.so | GPL |
+----------------------------+----------+--------------------+--------------------+---------+
43 rows in set (0.00 sec)

5、查看外掛程式的配置參數
mysql> show global VARIABLES like ‘%audit%‘;
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Variable_name | Value |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| audit_checksum | |
| audit_delay_cmds | |
| audit_delay_ms | 0 |
| audit_force_record_logins | ON |
| audit_header_msg | ON |
| audit_json_file | ON |
| audit_json_file_bufsize | 1 |
| audit_json_file_flush | OFF |
| audit_json_file_retry | 60 |
| audit_json_file_sync | 1 |
| audit_json_log_file | mysql-audit.json |
| audit_json_socket | OFF |
| audit_json_socket_name | /tmp/mysql.audit__data_mysql_3306_datadir_mysqldata_3306 |
| audit_json_socket_retry | 10 |
| audit_offsets | |
| audit_offsets_by_version | ON |
| audit_password_masking_cmds | CREATE_USER,GRANT,SET_OPTION,SLAVE_START,CREATE_SERVER,ALTER_SERVER,CHANGE_MASTER |
| audit_password_masking_regex | identified(?:/\*.*?\*/|\s)*?by(?:/\*.*?\*/|\s)*?(?:password)?(?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"]|password(?:/\*.*?\*/|\s)*?\((?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"](?:/\*.*?\*/|\s)*?\)|password(?:/\*.*?\*/|\s)*?(?:for(?:/\*.*?\*/|\s)*?\S+?)?(?:/\*.*?\*/|\s)*?=(?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"]|password(?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"] |
| audit_record_cmds | |
| audit_record_objs | |
| audit_uninstall_plugin | OFF |
| audit_validate_checksum | ON |
| audit_validate_offsets_extended | ON |
| audit_whitelist_cmds | BEGIN,COMMIT |
| audit_whitelist_users | |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
25 rows in set (0.01 sec)

6、驗證審計
[[email protected]_166_132 mysqldata]# tailf /data/mysql/mysql-audit.json
{"msg-type":"activity","date":"1480659848340","thread-id":"4","query-id":"12","user":"root","priv_user":"root","host":"","ip":"127.0.0.1","cmd":"show_variables","objects":[{"db":"information_schema","name":"/tmp/#sql_6a75_0","obj_type":"TABLE"}],"query":"SHOW GLOBAL VARIABLES LIKE ‘plugin_dir‘"}
{"msg-type":"activity","date":"1480659883722","thread-id":"4","query-id":"13","user":"root","priv_user":"root","host":"","ip":"127.0.0.1","cmd":"show_plugins","objects":[{"db":"information_schema","name":"/tmp/#sql_6a75_0","obj_type":"TABLE"}],"query":"show plugins"}

7、關閉審計

mysql> set GLOBAL audit_json_file=off ;
Query OK, 0 rows affected (0.01 sec)

8、禁用外掛程式

mysql> UNINSTALL PLUGIN AUDIT;
ERROR 1148 (42000): Uninstall AUDIT plugin disabled

線上禁用失敗，採取修改設定檔，重啟方式修改。

mysql添加mcafee 審計外掛程式