Download as PDF, PPTX
Uploaded byMarian Marinov
Securing your MySQL server
The document discusses the importance of securing MySQL servers, highlighting risks associated with storing sensitive data like passwords in plain text and vulnerabilities in default configurations. It emphasizes best practices like using secure hashing algorithms, encrypting sensitive data, implementing firewalls, and controlling access to MySQL sockets and authentication. Furthermore, it explores data encryption at rest and the limitations of built-in MySQL encryption features, recommending external tools for comprehensive security.
Securing your MySQL server
- 1.
- 2.
- 3.
- 4. Why?Why? ➢ Passwords storedin plain text ➢ E-Mail addresses ➢ Physical addresses ➢ Phone numbers ➢ Transaction information ➢ Sessions ➢ etc.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16. Chrooting will:Chrooting will: ➢ restrict FSaccess to the chroot dir ➢ prevent read/write to system files ➢ require SSL certs in the chroot dir ➢ restrict, where the temporary files can be created ➢ restrict the pid and log file locations
- 17. Firewalling the MySQLFirewalling the MySQL ➢ DO NOTPUT MySQL on unrestricted public interfaces # iptables -N mysql # iptables -A mysql -j ACCEPT -s IP_1 # iptables -A mysql -j ACCEPT -s NET_1 # iptables -A mysql -j DROP # iptables -A INPUT -j mysql -p tcp --dport 3306
- 18. Firewalling the MySQLFirewalling the MySQL ➢ Only disallowspecific user (app_userapp_user) # iptables -A OUTPUT -j DROP -p tcp --dport 3306 -m owner ! --uid-owner app_userapp_user
- 19. Firewalling the MySQLFirewalling the MySQL ➢ or morethen one user, but not everyone: # iptables -N mysql_out # iptables -A mysql_out -j ACCEPT -m owner --uid-owner app_user1app_user1 # iptables -A mysql_out -j ACCEPT -m owner --uid-owner app_user2app_user2 # iptables -A mysql_out -j DROP # iptables -I OUTPUT -j mysql_out -p tcp --dport 3306
- 20. Firewalling the MySQLFirewalling the MySQL ➢ or youwant only one specific user, to be restricted from MySQL # iptables -A OUTPUT -j DROP -p tcp --dport 3306 -m owner --uid-owner dev_user1dev_user1
- 21.
- 22. The effects of:The effects of: # chmod 600/var/lib/mysql/mysql.sock# chmod 600 /var/lib/mysql/mysql.sock - Only root & mysql have access to it- Only root & mysql have access to it - restrict all users- restrict all users - use sudo for devs- use sudo for devs dev_user1 ALL=(mysql) PASSWD:/usr/bin/mysqldev_user1 ALL=(mysql) PASSWD:/usr/bin/mysql
- 23. The socket protection:The socket protection: Your app needsaccess to the socket, so:Your app needs access to the socket, so: # groupadd# groupadd web_appweb_app # usermod -a -G# usermod -a -G web_appweb_app mysqlmysql # usermod -a -G# usermod -a -G web_appweb_app app_userapp_user # chmod 660 /var/lib/mysql/mysql.sock# chmod 660 /var/lib/mysql/mysql.sock # chgrp# chgrp web_appweb_app /var/lib/mysql/mysql.sock/var/lib/mysql/mysql.sock
- 24. MySQL authenticationMySQL authentication ➢ never leavea user without a password ➢ try not use the % in the host part of an account ➢ hostnames instead of IPs for user authentication and set skip_name_resolve ➢ do not set old_passwords=0 ➢ (pre mysql 4.1, hashing func. was producing 16bytes hash string)
- 25.
- 26. MySQL authenticationMySQL authentication mysql> SELECT PASSWORD('mypass');mysql>SELECT PASSWORD('mypass'); +--------------------++--------------------+ | PASSWORD('mypass') || PASSWORD('mypass') | +--------------------++--------------------+ | 6f8c114b58f2ce9e || 6f8c114b58f2ce9e | +--------------------++--------------------+ - try to avoid the mysql_native_password plugin(which- try to avoid the mysql_native_password plugin(which produces 41bytes hash string)produces 41bytes hash string) mysql> SELECT PASSWORD('mypass');mysql> SELECT PASSWORD('mypass'); +-------------------------------------------++-------------------------------------------+ | PASSWORD('mypass') || PASSWORD('mypass') | +-------------------------------------------++-------------------------------------------+ | *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4 || *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4 | +-------------------------------------------++-------------------------------------------+
- 27. The mysqlunsha1 attack y = SHA1(password) Onevery connection the server sends a salt(s) and the client computes a session token(x) x = y XOR SHA1(s + SHA1(y) ) the server will verify it with: SHA1(x XOR SHA1(s + SHA1(y) )) = SHA1(y) MySQL authenticationMySQL authentication
- 28.
- 29.
- 30.
- 31.
- 32.
- 33.
- 34. MySQL SQL SecurityMySQL SQL Security ➢ SQL SECURITY ➢DEFINER vs. INVOKER CREATE DEFINER = 'admin'@'localhost' PROCEDURE p1() SQL SECURITY DEFINERDEFINER BEGIN UPDATE t1 SET counter = counter + 1; END; ➢ Triggers and evnets are always executed with definer's context
- 35.
- 36.
- 37.
- 38. Other limitationsOther limitations ➢ Galera gcacheis not encrypted ➢ .frm files are not encrypted ➢ mysqlbinlogs can no longer read the files ➢ Percona XtraBackup can't backup encrypted data ➢ Audit plugin can't create encrypted output ➢ general and slow logs, can't be encrypted ➢ error.log is not encrypted
- 39.
- 40.