MySQL Database Security Best Practices

MySQL is one of the most popular open-source databases that runs on a variety of platforms. It is relatively easy to configure, simple, and shows good performance characteristics even under significant load but it still has a wide variety of security-relevant configuration issues.

MySQL Database Security Best Practices

The very best practice of security management is to be paranoid and anticipate an attack any minute from every direction, but if you adopt some precautionary measures, it won’t be such a hard work. Following guidelines will help you to substantially reduce the surface of possible threats.

First of all, read security guidelines at http://dev.mysql.com/doc/refman/5.7/en/security.html and check for updates regularly. Several serious vulnerabilities have been found recently for MySQL RDBMS which have freely available exploits. Take advantage of updates that add new features and more importantly, fix security flaws.

Regularly monitor vulnerability databases. Always be aware of newly found threats to your system.

Operating System

  1. Turn off unnecessary daemons and services. The fewer components attackers can access the less is the chance of them finding a flaw that can be used to gain access to the system. By keeping the host configuration simple you reduce the effort needed to manage the system and mitigate the risk of security omissions.
  2. Ensure that MySQL users cannot access files outside of a limited set of directories. MySQL data files should not be read by any users except for root or administrator accounts.
  3. Disable or restrict remote access. In case you need your MySQL to be accessed remotely, configure GRANT statement, which is used to set up the user, to require SSL.
  4. Make sure that no user other than MySQL user can read MySQL configuration and log files. Files my.cnf, my.ini and master.info commonly have unencrypted usernames and passwords. If there is a query log file, it is likely to contain passwords as well. Some MySQL configuration files can also contain plaintext usernames and passwords. Ensure that these files are protected from unwanted users.
  5. Run MySQL with the –chroot option. It provides an excellent mitigation to the power of the file privilege. Chroot is used to restrict file access by a process to a given directory. Even with the chroot option, an attacker that gains file privilege will be able to read all MySQL data and probably still be able to execute UDF’s.
  6. Regularly clear your .mysql_history file or permanently link it to /dev/null.