Making MySQL Secure Against Attackers
569
PHP programmers migrating their MySQL databases from version 4.0 or lower to version 4.1 or higher
should see
Section 20.7, “MySQL PHP API”
.
6.1.3. Making MySQL Secure Against Attackers
When you connect to a MySQL server, you should use a password. The password is not transmitted in
clear text over the connection. Password handling during the client connection sequence was upgraded
in MySQL 4.1.1 to be very secure. If you are still using pre-4.1.1-style passwords, the encryption
algorithm is not as strong as the newer algorithm. With some effort, a clever attacker who can sniff
the traffic between the client and the server can crack the password. (See
Section 6.1.2.4, “Password
Hashing in MySQL”
, for a discussion of the different password handling methods.)
All other information is transferred as text, and can be read by anyone who is able to watch the
connection. If the connection between the client and the server goes through an untrusted network,
and you are concerned about this, you can use the compressed protocol to make traffic much more
difficult to decipher. You can also use MySQL's internal SSL support to make the connection even
more secure. See
Section 6.3.6, “Using SSL for Secure Connections”
. Alternatively, use SSH to get
an encrypted TCP/IP connection between a MySQL server and a MySQL client. You can find an Open
Source SSH client at
http://www.openssh.org/
, and a commercial SSH client at
http://www.ssh.com/
.
To make a MySQL system secure, you should strongly consider the following suggestions:
• Require all MySQL accounts to have a password. A client program does not necessarily know
the identity of the person running it. It is common for client/server applications that the user can
specify any user name to the client program. For example, anyone can use the
mysql
program
to connect as any other person simply by invoking it as
mysql -u other_user db_name
if
other_user
has no password. If all accounts have a password, connecting using another user's
account becomes much more difficult.
For a discussion of methods for setting passwords, see
Section 6.3.5, “Assigning Account
Passwords”
.
• Make sure that the only Unix user account with read or write privileges in the database directories is
the account that is used for running
mysqld
.
• Never run the MySQL server as the Unix
root
user. This is extremely dangerous, because any
user with the
FILE
[577]
privilege is able to cause the server to create files as
root
(for example,
~root/.bashrc
). To prevent this,
mysqld
refuses to run as
root
unless that is specified explicitly
using the
--user=root
[424]
option.
mysqld
can (and should) be run as an ordinary, unprivileged user instead. You can create a
separate Unix account named
mysql
to make everything even more secure. Use this account only
for administering MySQL. To start
mysqld
as a different Unix user, add a
user
option that specifies
the user name in the
[mysqld]
group of the
my.cnf
option file where you specify server options.
For example:
[mysqld]
user=mysql
This causes the server to start as the designated user whether you start it manually or by using
mysqld_safe
or
mysql.server
. For more details, see
Section 6.1.5, “How to Run MySQL as a
Normal User”
.
Running
mysqld
as a Unix user other than
root
does not mean that you need to change the
root
user name in the
user
table. User names for MySQL accounts have nothing to do with user names
for Unix accounts.
• Do not grant the
FILE
[577]
privilege to nonadministrative users. Any user that has this privilege
can write a file anywhere in the file system with the privileges of the
mysqld
daemon. This
includes the server's data directory containing the files that implement the privilege tables. To make
Summary of Contents for 5.0
Page 1: ...MySQL 5 0 Reference Manual ...
Page 18: ...xviii ...
Page 60: ...40 ...
Page 396: ...376 ...
Page 578: ...558 ...
Page 636: ...616 ...
Page 844: ...824 ...
Page 1234: ...1214 ...
Page 1427: ...MySQL Proxy Scripting 1407 ...
Page 1734: ...1714 ...
Page 1752: ...1732 ...
Page 1783: ...Configuring Connector ODBC 1763 ...
Page 1793: ...Connector ODBC Examples 1773 ...
Page 1839: ...Connector Net Installation 1819 2 You must choose the type of installation to perform ...
Page 2850: ...2830 ...
Page 2854: ...2834 ...
Page 2928: ...2908 ...
Page 3000: ...2980 ...
Page 3122: ...3102 ...
Page 3126: ...3106 ...
Page 3174: ...3154 ...
Page 3232: ...3212 ...