Securing your MySQL server
0 likes317 views
The document discusses the importance of securing MySQL servers, highlighting risks associated with storing sensitive data like passwords in plain text and vulnerabilities in default configurations. It emphasizes best practices like using secure hashing algorithms, encrypting sensitive data, implementing firewalls, and controlling access to MySQL sockets and authentication. Furthermore, it explores data encryption at rest and the limitations of built-in MySQL encryption features, recommending external tools for comprehensive security.
Securing your MySQL server
- 2. Who am I? :)
- 4. Why?Why? ➢ Passwords stored in plain text ➢ E-Mail addresses ➢ Physical addresses ➢ Phone numbers ➢ Transaction information ➢ Sessions ➢ etc.
- 15. Chrooting the MySQL Chrooting the MySQL daemondaemon chroot=/var/lib/mysql chroot=/var/lib/mysql
- 16. Chrooting will:Chrooting will: ➢ restrict FS access to the chroot dir ➢ prevent read/write to system files ➢ require SSL certs in the chroot dir ➢ restrict, where the temporary files can be created ➢ restrict the pid and log file locations
- 17. Firewalling the MySQLFirewalling the MySQL ➢ DO NOT PUT MySQL on unrestricted public interfaces # iptables -N mysql # iptables -A mysql -j ACCEPT -s IP_1 # iptables -A mysql -j ACCEPT -s NET_1 # iptables -A mysql -j DROP # iptables -A INPUT -j mysql -p tcp --dport 3306
- 18. Firewalling the MySQLFirewalling the MySQL ➢ Only disallow specific user (app_userapp_user) # iptables -A OUTPUT -j DROP -p tcp --dport 3306 -m owner ! --uid-owner app_userapp_user
- 19. Firewalling the MySQLFirewalling the MySQL ➢ or more then one user, but not everyone: # iptables -N mysql_out # iptables -A mysql_out -j ACCEPT -m owner --uid-owner app_user1app_user1 # iptables -A mysql_out -j ACCEPT -m owner --uid-owner app_user2app_user2 # iptables -A mysql_out -j DROP # iptables -I OUTPUT -j mysql_out -p tcp --dport 3306
- 20. Firewalling the MySQLFirewalling the MySQL ➢ or you want only one specific user, to be restricted from MySQL # iptables -A OUTPUT -j DROP -p tcp --dport 3306 -m owner --uid-owner dev_user1dev_user1
- 22. The effects of:The effects of: # chmod 600 /var/lib/mysql/mysql.sock# chmod 600 /var/lib/mysql/mysql.sock - Only root & mysql have access to it- Only root & mysql have access to it - restrict all users- restrict all users - use sudo for devs- use sudo for devs dev_user1 ALL=(mysql) PASSWD:/usr/bin/mysqldev_user1 ALL=(mysql) PASSWD:/usr/bin/mysql
- 23. The socket protection:The socket protection: Your app needs access to the socket, so:Your app needs access to the socket, so: # groupadd# groupadd web_appweb_app # usermod -a -G# usermod -a -G web_appweb_app mysqlmysql # usermod -a -G# usermod -a -G web_appweb_app app_userapp_user # chmod 660 /var/lib/mysql/mysql.sock# chmod 660 /var/lib/mysql/mysql.sock # chgrp# chgrp web_appweb_app /var/lib/mysql/mysql.sock/var/lib/mysql/mysql.sock
- 24. MySQL authenticationMySQL authentication ➢ never leave a user without a password ➢ try not use the % in the host part of an account ➢ hostnames instead of IPs for user authentication and set skip_name_resolve ➢ do not set old_passwords=0 ➢ (pre mysql 4.1, hashing func. was producing 16bytes hash string)
- 26. MySQL authenticationMySQL authentication mysql> SELECT PASSWORD('mypass');mysql> SELECT PASSWORD('mypass'); +--------------------++--------------------+ | PASSWORD('mypass') || PASSWORD('mypass') | +--------------------++--------------------+ | 6f8c114b58f2ce9e || 6f8c114b58f2ce9e | +--------------------++--------------------+ - try to avoid the mysql_native_password plugin(which- try to avoid the mysql_native_password plugin(which produces 41bytes hash string)produces 41bytes hash string) mysql> SELECT PASSWORD('mypass');mysql> SELECT PASSWORD('mypass'); +-------------------------------------------++-------------------------------------------+ | PASSWORD('mypass') || PASSWORD('mypass') | +-------------------------------------------++-------------------------------------------+ | *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4 || *6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4 | +-------------------------------------------++-------------------------------------------+
- 27. The mysqlunsha1 attack y = SHA1(password) On every connection the server sends a salt(s) and the client computes a session token(x) x = y XOR SHA1(s + SHA1(y) ) the server will verify it with: SHA1(x XOR SHA1(s + SHA1(y) )) = SHA1(y) MySQL authenticationMySQL authentication
- 34. MySQL SQL SecurityMySQL SQL Security ➢ SQL SECURITY ➢ DEFINER vs. INVOKER CREATE DEFINER = 'admin'@'localhost' PROCEDURE p1() SQL SECURITY DEFINERDEFINER BEGIN UPDATE t1 SET counter = counter + 1; END; ➢ Triggers and evnets are always executed with definer's context
- 38. Other limitationsOther limitations ➢ Galera gcache is not encrypted ➢ .frm files are not encrypted ➢ mysqlbinlogs can no longer read the files ➢ Percona XtraBackup can't backup encrypted data ➢ Audit plugin can't create encrypted output ➢ general and slow logs, can't be encrypted ➢ error.log is not encrypted