Reviewing MySQL Security - Revision history

Milan Singh Thakur: /* Remote Access */

2015-02-13T09:47:21Z

‎Remote Access

Milan Singh Thakur: /* Remote Access */

2015-02-13T09:29:55Z

‎Remote Access

Milan Singh Thakur: /* Privileges */

2015-02-13T09:29:28Z

‎Privileges

Milan Singh Thakur: /* Remote Access */

2015-02-13T09:21:24Z

‎Remote Access

Milan Singh Thakur: /* Default MySQL Accounts */

2015-02-13T09:10:43Z

‎Default MySQL Accounts

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:50:37Z

Added navigation to facilitate sequential reading online

KirstenS: /* Introduction */

2009-01-29T01:31:33Z

‎Introduction

KirstenS: /* Remote Access */

2009-01-15T20:39:58Z

‎Remote Access

KirstenS at 20:39, 15 January 2009

2009-01-15T20:39:39Z

Rahimjina: Review

2008-08-26T21:48:04Z

Review

← Older revision		Revision as of 09:47, 13 February 2015
Line 95:		Line 95:
	Also you should change the Default port number from 3306 to some other port.		Also you should change the Default port number from 3306 to some other port.
	Additionally, you can use '''bind= local_ip''' in /etc/my.cnf file. this will ensure that you DB is not accessible on Public IP.		Additionally, you can use '''bind= local_ip''' in /etc/my.cnf file. this will ensure that you DB is not accessible on Public IP.
		+
		+
		+	===Additional Chacks===
		+	1. Avoid " SELECT * " in queries.
		+
		+	2. Create views to simplify commonly-used Table joins.
		+
		+	3. Strictly avoid plain text passwords in Scripts and tables.
		+
		+	4. Avoid using FQDN or hostnames when granting access.
		+
		+	5. Use phpMyAdmin to add a user.
		+
		+	6. Check for CHANGE LOG file to see if patches are applied.
		+
		+	7. Remove test database and access to it.
		+
		+	8. Do not create demo or test databases on production servers, keep it clean and safe.

@@ Line 92: / Line 92: @@
 MySQL by default listens on port 3306. If the app server is on localhost also, we can disable this port by adding
 '''skip-networking''' to the [mysqld] in the my.cnf file.
 Also you should change the Default port number from 3306 to some other port.
 Additionally, you can use '''bind= local_ip''' in /etc/my.cnf file. this will ensure that you DB is not accessible on Public IP.

@@ Line 11: / Line 11: @@
 ===Privileges===
-'''Grant_priv''': Allows users to grant privileges to other users. This should be appropriately restricted to the DBA and Data (Table) owners.
+'''Grant_priv''': Allows users to grant privileges to other users. This should be appropriately restricted to the DBA and Data (Table) owners. Give specific permissions on an as needed basis and use different logins for different purposes.
   Select * from user

@@ Line 92: / Line 92: @@
 MySQL by default listens on port 3306. If the app server is on localhost also, we can disable this port by adding
 '''skip-networking''' to the [mysqld] in the my.cnf file.
 {{LinkBar

@@ Line 85: / Line 85: @@
   FROM user
   WHERE User = 'root';
 ===Remote Access===

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 ==Introduction==
@@ Line 83: / Line 89: @@
 MySQL by default listens on port 3306. If the app server is on localhost also, we can disable this port by adding
 '''skip-networking''' to the [mysqld] in the my.cnf file.
 [[Category:OWASP Code Review Project]]

@@ Line 2: / Line 2: @@
 ==Introduction==
-As part of the code review, you may need to step outside the code review box to assess the security of a database such as MySQL. The following covers areas which could be looked at:
+As part of the code review, you may need to step outside the code review box to assess the security of a database such as MySQL. The following covers areas which could be looked at.
 ===Privileges===

← Older revision		Revision as of 20:39, 15 January 2009
Line 85:		Line 85:

	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]
−	~~[[Category:MySQL security]]~~

@@ Line 2: / Line 2: @@
 ==Introduction==
-As part of the code review you may need to step outside the code review box to assess the security of a database such as MySQL.
+As part of the code review, you may need to step outside the code review box to assess the security of a database such as MySQL. The following covers areas which could be looked at:
 ===Privileges===
 '''Grant_priv''': Allows users to grant privileges to other users. This should be appropriately restricted to the DBA and Data (Table) owners.
   Select * from user
@@ Line 21: / Line 19: @@
   where Table_priv = 'Grant';
-'''Alter_priv''':Determine who has access to make changes to the database structure (alter privilege) at a global, database and table.
+'''Alter_priv''': Determine who has access to make changes to the database structure (alter privilege) at a global, database, and table level.
   Select * from user
@@ Line 35: / Line 33: @@
   where Table_priv = 'Alter';
-====mysqld configuration file====
+====MySQL Configuration File====
 Check for the following:
-  a)skip-grant-tables
+  a) skip-grant-tables
-  b)safe-show-database
+  b) safe-show-database
-  c)safe-user-create
+  c) safe-user-create
-'''a)'''This option causes the server not to use the privilege system at all. All users have full access to all tables
+'''b)''' When the '''SHOW DATABASES''' command is executed, it returns only those databases for which the user has some kind of privilege. Default since MySQL v4.0.2.
-====User privileges====
+'''c)''' With this enabled a user can't create new users with the GRANT command as long as the user does not have the '''INSERT''' privilege for the '''mysql.user table'''.
   Select * from user where
@@ Line 74: / Line 73: @@
   or Index_priv = 'Y' or Alter_priv = 'Y';
-===Default MySQL accounts===
+===Default MySQL Accounts===
-The default account in MySQl is "root"/"root@localhost" with a blank password. We can check if the root account exists by:
+The default account in MySQL is "root"/"root@localhost" with a blank password. We can check if the root account exists by:
   SELECT User, Host
@@ Line 82: / Line 81: @@
 ===Remote Access===
-MySQL by default listens on port 3306. If the app server is on localhost also we can disable this port by adding
+MySQL by default listens on port 3306. If the app server is on localhost also, we can disable this port by adding
 '''skip-networking''' to the [mysqld] in the my.cnf file.
 [[Category:OWASP Code Review Project]]
 [[Category:MySQL security]]