Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the best way to implement access control to production MySQL instances?

The aim is not ban the developers from accessing the MySQL but performing LDAP authentication and audit logging of MySQL modifications to the databases.

Is there a way the command line client mysql provides, LDAP auth and Audit logging?

share|improve this question

There's no point putting access control on the command line client; anyone who wants to break your database can trivially avoid using the CLI.

MySQL does have the ability to log all queries along with the username who issued it, but it's not a particularly good idea to enable it on production systems as it does unpleasant things to performance (a lot of disk IO is generated by writing every query to disk).

Finally, as far as LDAP (or other external auth) goes, MySQL is heavily mired in it's own little world of authentication; it's something that used to bug the crap out of me, but I've come to accept it as just one of those things that databases do.

I just avoid letting people play on production databases without adult supervision. The amount of damage to production operation that a well-intentioned fool can do with a poorly-considered query is considerable. Yes, developers don't like it, and no, I don't care.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.