2

Being a newcomer to using and administering MySQL servers, I am looking for resources to get up to speed on the current situation of MySQL Security. Please share any resources you may know about, or experiences from which you have gained important knowledge in this area.

4
  • Community wiki?
    – pjmorse
    Oct 13, 2010 at 12:51
  • I can see this being a good wiki. How would I go about this?
    – Chrisc
    Oct 13, 2010 at 16:03
  • Click the "edit" link, then you should see a checkbox under the question box called "Community Wiki." Take a look at the FAQ, though.
    – pjmorse
    Oct 13, 2010 at 16:27
  • Given my lack of rep points, anyone willing to make this a Community Wiki?
    – Chrisc
    Mar 23, 2011 at 21:01

4 Answers 4

3

That is a very broad topic indeed.

The first thing you should do is run: mysql_secure_installation

You should come to understand the MySQL Privilege system: http://dev.mysql.com/doc/refman/5.0/en/privilege-system.html . Whenever possible you should grant only those privileges necessary for your application (i.e. it is not uncommon for people to just do a GRANT ALL PRIVILEGES which is almost always unnecessary).

The book "High Performance MySQL" (Schwartz et al.) contains a chapter on Security and offers some best practices.

In large part though the answer depends upon your particular application and the type of users it is exposed to. i.e. If it's a web application you might want to consider a DB Firewall like GreenSQL since SQL Injection is a popular attack vector.

2

You should read Hackproofing MySQL. If SQL Injection applies to your application, such as all web applications, then BY FAR most dangerous privilege is FILE.

0
2

Since you are new to MySQL Administration, I would recommend the following:

MySQL 5.0 Certification Study Guide
http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Daps&field-keywords=0-672-32812-7

Chapter 34 : User Management
Chapter 35 : Securing the MySQL Installation

I studied this book tooth and nail for the Certification Exam and I still refer to it. Please read it. I recommended this book in my LinkedIn page and in Amazon.com

This was my critique of the book as stored in Amazon.com

1 of 1 people found the following review helpful: 5.0 out of 5 stars MySQL Certified because of this book, November 2, 2007 By Rolando A. Edwards (Jersey City, NJ) - See all my reviews (REAL NAME) This review is from: MySQL 5.0 Certification Study Guide (Paperback) I studied for the MySQL DBA exam using this book, chapters 23-42. I passed both exams on the first try two weeks apart. I can truthfully say that in order to pass both exams, you must know certain facts from several different chapters to answer a single question. This is especially true for mutiple choice questions that require multiple answers. While there are many typos and changes to MySQL since the books release, just go to the URL http://www.mysql.com/certification/studyguides/errata50.html and make those corrections, and you will find that this book is indeed a complete study guide. The developer chapters (1-22) are just as replete with needed info. Have fun studying the book and passing the exams.

1

Remember to secure the file system too. Assuming you're installing on linux;

  • Create a mysql user and don't allow interactive logon for the user
  • Change the ownership of all mysql files/directories to the mysql user
  • Remove read/write/execute privileges on mysql files/directories for all but the owner

Also see http://dev.mysql.com/doc/refman/5.1/en/security-against-attack.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .