mysql security

as you know,security is not absolute,which  contains three aspects: network security,mainframe  security and the  mysql server  itself. generally the network security isn’t  at the  scope  of software engineer business,while the mainframe security  equal as the operate system security that  we should consider.so we should  consider it as following:

 

1.create individual user and group to start up the mysql  server  ,which also  have  the privilege that only  confines  to  the operation relates  to  itself.

if start up mysql server by administrative role that such as root account, an account who have file  privilege can do everything ,because mysql server allow it to execute  command that contains  malicious propose  to destroy  or illegally attain other accounts information  in this system.

 

2. use safe mysqld-safe  process to start up my server because the daemon  mysqld-safe is even safer than daemon mysqld process.

 

3.  the directory that mysql  installed  or data store own privilege must be one user that we first create to start up mysql process. hence other users can’t to access the directory except have more privileges root group.

 

4. it would is best to  guarantee mysql server run in  separate machine that  reduce database visited pressure and make it better to offer service to store data.

 

 

then we consider it to gain more mysql securities  to guarantee mysql server not illegal invade or crush. generally having a principle  is asssigning a account  appropriate right to deal right things, otherwise when a account have more rights that not belonged. it’s more risk to destroy system.

 

how to accomplish it?

1.confining account connect database server by remote way.what that mean? can’t use  the symbol “%”,it would allow every account in  database account system, it’s too more risk. we must constrain it to define invariable ip address or domain to connect the mysql server.  Meanwhile the user have access database by  local host way in cause ip change.  in addition root user that database system default the largest power account  can’t allow it connect database server by remote method,but we must let it access by lcoal way.

 

2.assigning  different account  appropriate privilege,furthermore  you need to create some account to do individual task,for example,you need  a account is responsible for  dumping sql file ,backup and restore database.

you need a account to access special  database in order to read and write the table  data  that cooperate  appliance such as website,software  based on database drive.

you need  a account  to replicate  database etc.  it should have FILE privilege etc.

 

3.be aware of OPTION privilege, must be guarantee  the account that it has option to be a administrative role.