2
votes
0answers
80 views

What kind of hacking attempt is this? [closed]

This past week, my traffic logs are showing many hits (usually with repeated tries) for a url from perhaps 30+ different ip addresses all over the world. This is not a url that should garner more than ...
0
votes
0answers
38 views

Encrypt MySQL column with ssh-key forwarded by ssh-agent

I would like to keep sensitive data such as user's e-mail address in MySQL database in encrypted form. Is it possible to encrypt/decrypt mail column in MySQL using ssh-key forwarded by ssh-agent on ...
-2
votes
1answer
446 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [duplicate]

As part of hardening a standalone/dedicated MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL ...
-1
votes
1answer
42 views

Site security - how to filter incoming traffic to a specific port

Just ran a security test on ScanMyServer.com, the results showed a medium risk vulnerability: Database Reachable from the Internet Summary: The remote host is running a database server that is ...
0
votes
2answers
886 views

Allow linux root user mysql root access without password

On cPanel when I am logged in as root and type "mysql" without hostname and password it gives me direct access to mysql root user. I would like to do this for one of my non-cpanel server where the ...
0
votes
0answers
78 views

mysqldump over ssh and mysql restore - security issue?

I've just found a one liner to mirror a local mysql database on a remote server, over ssh: mysqldump -uroot -proot zedatabase | ssh -p4551 geek@12.34.56.78 "mysql -udoom -pmySqlPassword zedatabase" ...
-5
votes
1answer
53 views

Ticketing server database security [closed]

I want to setup a ticketing system which will show the seats available instantly. However, for security, I do not want to open my database in internet. I want to setup a server which has public IP and ...
2
votes
3answers
150 views

MySQL Injection Attacks? Random URL's Causing Errors

We just started running our own web server a few months ago on Rackspace (they are great). I use NewRelic (also pretty cool) to monitor server usage and I am getting error alerts that appear to me to ...
2
votes
3answers
112 views

Should I set a mysql root password?

I have a webserver hosted on AWS, with the security group allowing access from all IP address's to TCP port 22 (ssh) and 443 (https). ssh access requires a user to have my private key. Should the ...
0
votes
1answer
101 views

Is the connection from PHP to a different MySQL server 100% secure?

I tried to find this information but was not able to. How is working the connection from PHP to MySQL server. As the password is sored plain, is it also sent plain to MySQL if it is stored on a ...
0
votes
1answer
79 views

More secure way of sending MySQL commands from a remote server on the command line

What is the most secure way of running SQL commands from a web server to a remote MySQL server from the command line. I can think of two ways: mysql --host mysql.mydomain.com --user admin --password ...
-1
votes
1answer
85 views

Database connection to another server

I have 2 Servers - one for PHP, and one for MySQL Both servers are hardened - and now my question is, what's the correct way to set up a connection to the Database Server, from PHP? Probably over ...
-2
votes
2answers
44 views

Recommended UNIX user for CMS access to MySQL [closed]

This article recommends the UNIX nobody user to access MySQL from Joomla scripts. Is this standard practice? Moreover, is it reasonable to use it, say, both for Joomla and WordPress?
-3
votes
2answers
62 views

Improving server security [closed]

I've been developing webapps for a while ... and I always had a sysadmin which made the environment perfect to run my apps with no worries. But now I am starting a project on myself, and I need to ...
1
vote
2answers
111 views

What is the most secure way to set up a mysql user for Wordpress?

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
0
votes
1answer
186 views

Finding malicious code injected into MySQL [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I've got a new client whose site looks like it has been hacked. It's running Drupal and I have run Hacked on it to verify that the ...
0
votes
1answer
2k views

How to disable LOCAL INFILE in MySql 5.5 Ubuntu 12.04

Cannot disable LOCAL INFILE ( for security reasons ) in mysql Ver 14.14 Distrib 5.5.25a, for debian-linux-gnu (i686) using readline 6.2 on ubuntu 12.04; Here is my /etc/mysql/my.cnf [client] port ...
1
vote
1answer
2k views

Allow any ip to connect to Amazon Web Services RDS using MySQL

Is it possible to allow any IP to connect to a Amazon RDS instance using MySQL? Explaining my scenario as requested in the comments: Amazon RDS by default blocks all the incoming connections which ...
1
vote
0answers
25 views

Is it possible to secure MySQL admin password with digital certificate on windows

I'd like to know if it is possible: I searched google but couldn't find.
8
votes
3answers
815 views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
5
votes
2answers
778 views

Is it ok to leave the MySQL root password blank?

Does a root user without a password constitute a security breach if my MySQL server only accepts connections from localhost? I'm aware that the common wisdom says the root user should be protected by ...
1
vote
2answers
922 views

Prevent SQL injection in Magento (Search Terms)

My question is, what can be done to prevent malicious search phrases in mysql databases? Search terms spamming example: guayabera en ...
1
vote
1answer
73 views

How to restrict mysqlimport usage?

I have a need in my PHP application (using Zend Framework for what it matters), to import a CSV file into a MySQL database. I currently do this by using shell_exec() to run a myysqlimport command ...
1
vote
1answer
406 views

Secure connection to MySQL with VPN?

I have a VPS with MySQL 5.5, which is listening only on localhost because of obvious security reasons. I have set up VPN connection from my own machine to that VPS and I connect successfully. What ...
2
votes
3answers
159 views

Secure method to access Amazon EC2 server hosted databse

I have mysql database hosted on Amazon EC2 server and i want to access it remotely to make changes to it. As i dont have static IP, i cannot allow specific IP in firewall for secure access to port ...
3
votes
4answers
155 views

How do I prevent remote acces to MySQL?

I have a CentOS server running a MySQL server. I would like to prevent remote access to MySQL. How can I achieve this?
-1
votes
1answer
91 views

Security: MySql passwords, are they safe from lookup tables (followup)

Followup to Security: Where are MySQL passwords stored? The MySQL documentation provided as reference to the accepted answer does not provide any information if additional information (SALTS) is used ...
5
votes
3answers
1k views

Security: Where are MySQL passwords stored?

Where are MySQL passwords stored and are they encrypted or even hashed?
-3
votes
2answers
102 views

Is it enough just to install LAMP? [closed]

I use yum to install LAMP on Centos, like this: yum install httpd mysql mysql-server php php-mysql chkconfig --levels 235 httpd on chkconfig --levels 235 mysqld on service httpd start service ...
2
votes
3answers
122 views

Securing a LAMP host from physical data extraction

This is more of a theoretical question and request for advice and pointers than a question about specific software. I have a distro-agnostic Linux machine (meaning I don't really care what to put in ...
3
votes
2answers
875 views

Weird MySQL Users Been Created (eg. bug115166_10073) and not by me

Have just been looking at my MySQL user permissions during a security audit and have noticed about 20 MySQL users have been created with random names such as 'bug115166_10073'. They don't have any ...
2
votes
2answers
145 views

Is there a password agent for the mysql command-line client?

I use the mysql command line client frequently. Sometimes I wind up typing in my password dozens of times per day, and I'm getting really tired of it. SSH has a neat utility called ssh-agent which ...
2
votes
2answers
454 views

Issuing client SSL certificates for MySQL server to customers - is this safe?

I have MySQL installed on a VPS, which I will use to host multiple databases for customers, who will use them from a front-end. I have forced all communication to each database to be via SSL, and I ...
2
votes
2answers
237 views

Is it considered a bad idea to have a publicly facing MySQL or SQLServer Database?

If I wanted to create a publicly facing database for purposes of connecting it to a client MS Word or Open Office Writer installation, would this be considered a dangerous security practice? What if ...
1
vote
1answer
249 views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
0
votes
1answer
75 views

Web Server sercurity (used only for web services)

I am using a Virtual Private Server for accessing Web-Services used only on the Mobile devices, there are many entries in the access and error log, even there is nothing on the web server. I am ...
1
vote
3answers
77 views

Shared MySQL Database Security

I'm hoping to run a mysql server that would be accessed by 2 servers (one on linode, and one on amazon). So far we've just had the mysql server hosted on the linode box locally - so we haven't had to ...
1
vote
3answers
46 views

MySQL security settings ignore accounts limits?

After several years of using MySQL, I've encountered some security issue that quite baffle me. I create a new database, and a new user, then grant CRUD rights only to the new DB, to this user. But ...
1
vote
4answers
3k views

Is it safe to open port 3306 in Firewall for external MySQL Connection

This may be more of a server question, but it's development related, and since I'm a developer I hope it's appropriate here. I want to connect to a MySQL DB that is hosted with an ISP using something ...
0
votes
1answer
1k views

Enabling remote access to mysql on debian

I need to enable remote access for a specific user on a mysql server, running debian oldstable. Bear in mind I'm no SQL expert nor a real sysadmin. Logging in phpmyadmin and looking at the ...
2
votes
2answers
103 views

General firewall / security procedures for webservers & databases

My webserver and database server are separate. All I've done to secure the webserver is used ufw and denied from all except ports 22, 80, and 443. What else really needs to be done there? On my ...
2
votes
3answers
562 views

VPS set up for MySQL

Our VPS is set up in such a way that all databases are accessible from any domain via localhost and the username/password/dbname. Is this the usual set up, or should there be some way of 'jailing' ...
2
votes
2answers
82 views

account compromised, are there mysql logs?

Is there such a thing as mysql logs to determine if anything has been accessed/updated/removed. My account was compromised and it appears only spam scripts were uploaded. I changed all passwords and ...
19
votes
2answers
19k views

How bad is setting MySQL's bind-address to 0.0.0.0?

I'm trying to allow a remote server to access a MySQL instance that currently shares a Linux server with a web app. According to the documentation the only way this would be possible (unless I'm not ...
3
votes
3answers
489 views

Why is it advised give mysql user root@localhost a password?

When I installed the MySQL server RPM I got this message: PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL root USER ! If I can only use the mysql root user from localhost (i.e after logging in over ...
7
votes
3answers
4k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
6
votes
6answers
842 views

How should I set up protection for the database against sql injection when all the php scripts are flawed?

I've inherited a php web app that is very insecure, with a history of sql injection. I can't fix the scripts immediately, I rather need them to be running to have the website running, and there are ...
0
votes
4answers
362 views

Safety concerns on allowing connections to MySQL with no password on localhost?

In the case of a Linux system, is there any security concern to let MySQL users with standard privileges (that is, not the root users) connect to the database with no password from localhost? I think ...
3
votes
2answers
1k views

MySQL log shows 3 root users, 2 without passwords? Why?

Our MySQL log displayed a warning on restart about 2 root users not having passwords. I went into MySQL and checked all users: mysql> select * from mysql.user; and see: Host | User ...
0
votes
2answers
61 views

mysql and unix users control

Let's say I have two users on my UNIX machine - user1 and user2. I also have two MySQL databases - db1(mysql_user1) and db2(mysql_user2). I want to prevent user1 from connecting to db2 even if it ...