MySQL Database Asset Protection Standards:: Difference between revisions

From HORSE - Holistic Operational Readiness Security Evaluation.
Jump to navigation Jump to search
Line 11: Line 11:
   
   
==Prepare Chroot Environment==
==Prepare Chroot Environment==
<br>
In order to prepare the chrooted environment, we must create the following directory structure:<br>
In order to prepare the chrooted environment, we must create the following directory structure:<br>
<br>
<br>
Line 20: Line 19:
mkdir -p /chroot/mysql/usr/local/mysql/libexec<br>
mkdir -p /chroot/mysql/usr/local/mysql/libexec<br>
mkdir -p /chroot/mysql/usr/local/mysql/share/mysql/english<br>
mkdir -p /chroot/mysql/usr/local/mysql/share/mysql/english<br>
===Set Access Rights===
The access rights to the above directories should be set as follows:<br>
<br>
chown -R root:sys /chroot/mysql<br>
chmod -R 755 /chroot/mysql<br>
chmod 1777 /chroot/mysql/tmp<br>

Revision as of 13:45, 15 May 2007

Introduction

MySQL is one of the most popular databases on the Internet and it is often used in conjunction with PHP. Besides its undoubted advantages such as easy of use and relatively high performance, MySQL offers simple but very effective security mechanisms. Unfortunately, the default installation of MySQL, and in particular the empty root password and the potential vulnerability to buffer overflow attacks, makes the database an easy target for attacks.

This article describes the basic steps which should be performed in order to secure a MySQL database against both local and remote attacks.

Chrooting the server

The first step of securing MySQL is to prepare the chrooted environment, in which the MySQL server will run.

Operating system

The methods presented should also apply on most modern UNIX and UNIX-like systems.

Prepare Chroot Environment

In order to prepare the chrooted environment, we must create the following directory structure:

mkdir -p /chroot/mysql/dev
mkdir -p /chroot/mysql/etc
mkdir -p /chroot/mysql/tmp
mkdir -p /chroot/mysql/var/tmp
mkdir -p /chroot/mysql/usr/local/mysql/libexec
mkdir -p /chroot/mysql/usr/local/mysql/share/mysql/english

Set Access Rights

The access rights to the above directories should be set as follows:

chown -R root:sys /chroot/mysql
chmod -R 755 /chroot/mysql
chmod 1777 /chroot/mysql/tmp