SlideShare a Scribd company logo
1 of 67
Title




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Title


                           Better MySQL Security
                             and Administration
                                                 Ronald Bradford
                                            http://ronaldbradford.com
                                            Insight Out DB Showcase
                                                  October 2011




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
OBJECTIVE

                           Identify MySQL security issues
                           Improve MySQL installation process
                           Identify data issues
                           Improve data integrity and security
                           Auditing options


                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
ABOUT AUTHOR
                                                            Ronald BRADFORD

                           12 years with MySQL / 22 years with RDBMS
                             Senior Consultant at MySQL Inc (06-08)
                             Consultant for Oracle Corporation (96-99)

                           7 years presenting MySQL content
                           All time top MySQL blogger
                                                                                           Available NOW
                           Published author                                                 for consulting

                           Oracle ACE Director
                                                                                       http://RonaldBradford.com

                                EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
MySQL Security


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
install security

                           Default is woeful
                           Minimum
                            $ mysql_secure_installation
                           Recommended
                             Operating System
                             Permissions & Privileges

                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                                1

                 $ mysql -uroot




                                                                         For a default MySQL
                                                                installation, there is no password for
                                                                          super user account




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                               2

                 $ mysql

                 mysql> USE test


                                                                         For a default MySQL
                                                                   installation, there is anonymous
                                                                      access. More on this soon!




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                              3

                 $ sudo su -
                 $ mysql
                 $ cat ~/.my.cnf
                 [client]                                            Many host providers have the
                 user=root                                         superuser password in the default
                                                                            user config file
                 password=XXX

                 # Other users with logins
                 $ find / -name ".my.cnf"


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                               4

                 $ grep mysql $HOME/.*history
                 $ grep mysql /home/*/.*history



                                                                   Shell commands leave an audit
                                                                 history. If password is specified on
                                                                    command line, it is in history




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                            5
                 $ mysql -u<some not privileged user>
                 mysql> SELECT host,user,password FROM mysql.user;
                 +--------------+------+----------+
                 | host         | user | password |
                 +--------------+------+----------+
                 | localhost    | root |          |
                 | mactaz.local | root |          |
                 | 127.0.0.1    | root |          |
                 | ::1          | root |          |
                 | localhost    |      |          |
                 | mactaz.local |      |          Can you view MySQL privileges to
                                                  |
                 +--------------+------+----------+ find a user with more access?




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                             6
                 $ cd [mysql-data-dir] # e.g. /var/lib/mysql
                 $ cat master.info
                 15
                 mysql-bin.001536
                 20160154
                 10.0.0.1
                 repl
                 XXX
                 3306
                 60

                 $ mysql -urepl -pXXX -h10.0.0.1
                 mysql> SHOW GRANTS;
                                                                 Are datadir permissions secure?
                                                              Does replication connection have global
                                                                           permissions?

                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                                7
                 $ cd [mysql-data-dir] # e.g. /var/lib/mysql
                 $ strings mysql/user.MYD
                 ...
                 dba*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19

                 mysql> SELECT 'password',PASSWORD('password');
                 +----------+-------------------------------------------+
                 | password | PASSWORD('password')                      |
                 +----------+-------------------------------------------+
                 | password | *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 |
                 +----------+-------------------------------------------+
                 mysql> SELECT 'passwd',PASSWORD('passwd');
                 +--------+-------------------------------------------+
                 | passwd | PASSWORD('passwd')                        |
                 +--------+-------------------------------------------+
                 | passwd | *59C70DA2F3E3A5BDF46B68F5C8B8F25762BCCEF0 |
                 +--------+-------------------------------------------+

                                                                     Is datadir permissions secure?
                                                                   Can list all users and password hash

                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                 mysql>    CREATE SCHEMA IF NOT EXISTS hack;                                        7a
                 mysql>    use hack;
                 mysql>    CREATE TABLE words(word VARCHAR(100));
                 mysql>    LOAD DATA LOCAL INFILE '/tmp/passwords'
                     ->    INTO TABLE words(word);

                 mysql -uroot -e "SELECT word,PASSWORD(word) FROM
                 hack.words" --skip-column-names > /tmp/mysql-passwords
                 $ cat /tmp/mysql-passwords
                 password *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
                 passwd   *59C70DA2F3E3A5BDF46B68F5C8B8F25762BCCEF0
                 oracle   *2447D497B9A6A15F2776055CB2D1E9F86758182F
                 changeme *7ACE763ED393514FE0C162B93996ECD195FFC4F5
                 xxx   *3D56A309CD04FA2EEF181462E59011F075C89548


                                                                             Brute force checking

                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                                8
                 $ mysqld --skip-grant-tables

                 $ mysql -uroot

                 mysql> UPDATE mysql.user
                     -> SET password=PASSWORD('hacked');
                 mysql> FLUSH PRIVILEGES;




                                                                    If access to start and stop mysqld
                                                                    process, you can reset passwords.

                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Hacking MySQL
                                                                                              9
                 $ cat wordpress/wp-config.php
                 $ cat drupal/sites/default/settings.php

                 # Insert your application here




                                                                       Applications with cleartext
                                                                      passwords and user may have
                                                                           excessive privileges
                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Denial of Service
                               (DOS)


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Breaking MySQL
                 $ mysql
                 mysql> USE test
                 mysql> CREATE TABLE filldisk(c VARCHAR(1000));
                 mysql> INSERT INTO filldisk VALUES(REPEAT('x',1000)),(REPEAT('y',1000)),
                 (REPEAT('z',1000));
                 mysql> INSERT INTO filldisk SELECT a.c FROM filldisk a, filldisk b,
                 filldisk c, filldisk d, filldisk e;
                 Query OK, 243 rows affected (0.05 sec)
                 mysql> INSERT INTO filldisk SELECT a.c FROM filldisk a, filldisk b,
                 filldisk c, filldisk d, filldisk e;
                 Will it end?
                 mysql> SELECT POW(3,5);
                 +----------+
                 | pow(3,5) |
                 +----------+
                 |       243 |
                 +----------+
                 mysql> SELECT POW(243,5);
                 +-----------------+
                 | pow(243,5)      |
                 +-----------------+
                 | 847,288,609,443 |                                 Anonymous access.


                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Breaking MYSQL
                 # Steal CPU cycles
                 mysql> SELECT MD5(a.c), MD5(b.c)
                     -> FROM filldisk a, filldisk b ORDER BY RAND();




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
BREAKING MYSQL
                 # Force disk I/O
                 mysql> SET SESSION tmp_table_size=1024*4; # 4K

                 mysql> SELECT ...




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
install security

                           $ mysql_secure_installation
                            Remove anonymous users
                            Remove test database
                            Remove non ‘localhost’ root users
                            Set root password



                              EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
OS Security


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
OS Security

                           Defaults are not always secure
                           Separate Data/Binary Logs/Logs/
                           Configuration/Backups
                             Individual directory permissions
                           Never run mysqld as 'root' user
                                                                               • Minimize security risk
                                                                               • Better auditability


                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Data security
               $ ls -ld /var/lib/mysql
               drwxr-xr-x 6 mysql mysql 4096 Oct 13 16:45 /var/lib/mysql

               $ ls -l /var/lib/mysql
               total 3749488
               drwx------ 2 mysql mysql       4096 Oct 6 18:50 db1
               drwx------ 2 mysql mysql       4096 Jun 6 14:11 db2
               -rw-rw---- 1 mysql mysql 3298820096 Oct 16 20:42 ibdata1
               -rw-rw---- 1 mysql mysql 268435456 Oct 16 20:42 ib_logfile0
               -rw-rw---- 1 mysql mysql 268435456 Oct 16 20:42 ib_logfile1
               drwx------ 2 mysql mysql       4096 Jun 6 09:37 mysql
               srwxrwxrwx 1 mysql mysql          0 Oct 12 20:09 mysql.sock




                                                                    Change default configuration for
                                                                   socket=/var/run/mysql/mysql.sock


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Installation

                           Best Practice
                                        Single partition per
                                          MySQL Instance
                /mysql
                                                                                             Global files as symlinks
                   /etc                                                                          from partition
                   /data
                   /binlog                                         /etc/my.cnf
                   /log                                            /etc/profile.d/mysql.sh
                                                                   /etc/init.d/mysqld
                   /mysql-version


                                EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Installation

                           Software installed by root
                             Separate MySQL permissions for directories

                 $   chown     -R root:root /mysql
                 $   chown     -R mysql:mysql /mysql/{data,log,binlog,etc}
                 $   chmod     700 /mysql/{data,binlog}
                 $   chmod     750 /mysql/{etc,log}




                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
NETWORK

                           MySQL listens on one TCP/IP port
                            Default port is 3306
                            --skip-networking disables TCP/IP
                           Database does not require physical
                           web access generally
                            Firewall management

                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
User Privileges


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
User Privileges

                Best Practice
                 CREATE USER goodguy@localhost IDENTIFIED BY 'sakila';
                 GRANT CREATE,SELECT,INSERT,UPDATE,DELETE ON db.* TO
                                                                                                    ✔
                 goodguy@localhost;



                Normal Practice
                 CREATE USER superman@'%';
                 GRANT ALL ON *.* TO superman@'%';
                                                                                                    ✘
                                               http://dev.mysql.com/doc/refman/5.5/en/create-user.html
                                                      http://dev.mysql.com/doc/refman/5.5/en/grant.html


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
GRANT ALL ON *.*

                           GRANT ALL ON *.* TO user@’%’
                            *.* gives you access to all tables in all schemas
                            @’%’ give you access from any external location
                            ALL gives you
                            ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY
                            TABLES, CREATE USER, CREATE VIEW, DELETE, DROP, EVENT, EXECUTE, FILE,
                            INDEX, INSERT, LOCK TABLES, PROCESS, REFERENCES, RELOAD, REPLICATION
                            CLIENT, REPLICATION SLAVE, SELECT, SHOW DATABASES, SHOW VIEW,
                            SHUTDOWN, SUPER, TRIGGER, UPDATE, USAGE



                                EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
SUPER

                           SUPER
                            Bypasses read_only
                            Bypasses init_connect
                            Can Disable binary logging
                            Change configuration dynamically
                            No reserved connection
                              EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
SUPER/Read Only
                 $ mysql -ugoodguy -psakila db
                 mysql> insert into test1(id) values(1);
                 ERROR 1290 (HY000): The MySQL server is running with the
                 --read-only option so it cannot execute this statement                     ✔

                 $ mysql -usuperman db
                 mysql> insert into test1(id) values(1);
                 Query OK, 1 row affected (0.01 sec)
                                                                                            ✘

                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
SUPER / Connect
                 #my.cnf
                 [client]
                 init_connect=SET NAMES utf8


                 This specifies to use UTF8 for communication with client
                 and data




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Super / connect




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Super / connect

            ✔
            $ mysql -ugoodguy -psakila db

            mysql> SHOW SESSION VARIABLES LIKE 'ch%';
            +--------------------------+----------+
            | Variable_name            | Value    |
            +--------------------------+----------+
            | character_set_client     | utf8     |
            | character_set_connection | utf8     |
            | character_set_database   | latin1   |
            | character_set_filesystem | binary   |
            | character_set_results    | utf8     |
            | character_set_server     | latin1   |
            | character_set_system     | utf8     |
            +--------------------------+----------+




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Super / connect

            ✔                       $ mysql -usuperman db
            $ mysql -ugoodguy -psakila db
                                                                                             ✘
                                    mysql> SHOW SESSION VARIABLES LIKE
            mysql> SHOW SESSION VARIABLES LIKE 'ch%';
                                    'character%';
            +--------------------------+----------+
                                    +--------------------------+----------+
            | Variable_name             | Value
                                    | Variable_name|           | Value    |
            +--------------------------+----------+
                                    +--------------------------+----------+
            | character_set_client | character_set_client
                                        | utf8     |           | latin1   |
            | character_set_connection | utf8      |
                                    | character_set_connection | latin1   |
            | character_set_database character_set_database
                                    |   | latin1   |           | latin1   |
            | character_set_filesystem | binary    |
                                    | character_set_filesystem | binary   |
            | character_set_results | character_set_results
                                        | utf8     |           | latin1   |
            | character_set_server | character_set_server
                                        | latin1   |           | latin1   |
            | character_set_system | character_set_system
                                        | utf8     |           | utf8     |
            +--------------------------+----------+
                                    +--------------------------+----------+




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
SUPER/Binary Log
                 mysql> SHOW MASTER STATUS;
                 +-------------------+----------+--------------+------------------+
                 | File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
                 +-------------------+----------+--------------+------------------+
                 | binary-log.000001 |      354 |              |                  |
                 +-------------------+----------+--------------+------------------+
                                                                                1
                 mysql> INSERT INTO account VALUES (9,'New',100);
                 mysql> SET SQL_LOG_BIN=0;
                 mysql> UPDATE account SET balance=1,000 WHERE id=9;     2
                 mysql> SET SQL_LOG_BIN=1;
                 mysql> UPDATE balance SET balance = balance - 50 WHERE id=9;   3
                 mysql> SHOW MASTER STATUS;
                 +-------------------+----------+--------------+------------------+
                 | File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
                 +-------------------+----------+--------------+------------------+
                 | binary-log.000001 |      674 |              |                  |
                 +-------------------+----------+--------------+------------------+




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
SUPER and
                                     Binary Log (2)
                 $ mysqlbinlog binary-log.000001 --start-position=354 --stop-position=674

                 # at 354
                 #100604 18:00:08 server id 1 end_log_pos 450 Query thread_id=1 exec_time=0
                 error_code=0
                 use mysql/*!*/;
                 SET TIMESTAMP=1275688808/*!*/;
                                                                         1

                                                                                                 ✘
                 INSERT INTO account VALUES (9,'New',100);
                 /*!*/;
                 # at 579
                 #100604 18:04:31 server id 1 end_log_pos 674 Query thread_id=2 exec_time=0
                 error_code=0
                 use mysql/*!*/;
                 SET TIMESTAMP=1275689071/*!*/;
                 mysql> UPDATE balance SET balance = balance - 50 WHERE id=9;                3
                 /*!*/;
                 DELIMITER ;
                 # End of log file
                 ROLLBACK /* added by mysqlbinlog */;




                            EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
SUPER/Connection
                 $ mysql -uroot                                                             ✔
                 mysql> show global variables like 'max_connections';
                 +-----------------+-------+
                 | Variable_name   | Value |
                 +-----------------+-------+
                 | max_connections | 3     |
                 +-----------------+-------+
                 1 row in set (0.07 sec)

                 mysql> show global status like 'threads_connected';
                 +-------------------+-------+
                 | Variable_name     | Value |
                 +-------------------+-------+
                 | Threads_connected | 4     |
                 +-------------------+-------+



                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Super/Connection

                 $ mysql -uroot
                 mysql> SHOW PROCESSLIST;
                 +----+------+-----------+-------+---------+------+------------+---------------
                                                                                                  ✔
                 | Id | User | Host       | db   | Command | Time | State      | Info
                 +----+------+-----------+-------+---------+------+------------+---------------
                 | 13 | root | localhost | db1   | Query   | 144 | User sleep | UPDATE test1 ...
                 | 14 | root | localhost | db1   | Query   | 116 | Locked      | select * from test1
                 | 15 | root | localhost | db1   | Query   |   89 | Locked     | select * from test1

                 mysql>    KILL THREAD 13;




                 $ mysql -uroot
                 ERROR 1040 (HY000): Too many connections
                                                                                                  ✘

                                EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Application users
                                                                               • Track Data Security
                                                                               • Separation of responsibilities

                           Application Viewer (Read Only Access)
                             SELECT
                           Application User (Read/Write Access)
                             INSERT, UPDATE, DELETE, SELECT
                           Application DBA (Schema Access Only)
                             CREATE, DROP, CREATE ROUTINE,
                             SELECT, INSERT, UPDATE, DELETE, ...


                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
securich ACL

                           User privilege via roles
                           http://securich.com




                                                                                 Open source third
                                                                                  party package
                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
New features

                           User authentication interface (5.5)
     http://dev.mysql.com/doc/refman/5.5/en/authentication-plugins.html

                           PAM/LDAP Authentication (5.6 Enterprise)
                            http://blogs.oracle.com/MySQL/entry/new_commercial_extensions_for_mysql
        http://blogs.oracle.com/mysql_joro/entry/mysql_55_brings_in_new_ways_to_authenticate_users




                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Data Integrity


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Data Integrity
                 CREATE TABLE sample_data (
                   i TINYINT UNSIGNED NOT NULL,
                                                                                            ✔
                   c CHAR(2) NULL,
                   t TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
                 ) ENGINE=InnoDB DEFAULT CHARSET latin1;
                 INSERT INTO sample_data(i) VALUES (0), (100), (255);
                 Query OK, 3 rows affected (0.00 sec)
                 SELECT * FROM sample_data;
                 +-----+------+---------------------+
                 | i   | c    | t                   |
                 +-----+------+---------------------+
                 |   0 | NULL | 2010-06-06 13:28:44 |
                 | 100 | NULL | 2010-06-06 13:28:44 |
                 | 255 | NULL | 2010-06-06 13:28:44 |
                 +-----+------+---------------------+
                 3 rows in set (0.00 sec)



                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Data Integrity
                 mysql> INSERT INTO sample_data (i) VALUES (-1), (9000);                          ✘
                 mysql> SELECT * FROM sample_data;
                 +-----+------+---------------------+
                 | i   | c    | t                   |
                 +-----+------+---------------------+
                 |   0 | NULL | 2010-06-06 13:28:44 |
                 | 100 | NULL | 2010-06-06 13:28:44 |
                 | 255 | NULL | 2010-06-06 13:28:44 |
                 |   0 | NULL | 2010-06-06 13:32:52 |
                 | 255 | NULL | 2010-06-06 13:32:52 |
                 +-----+------+---------------------+
                 5 rows in set (0.01 sec)


                                                                            Data In != Data out


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
SQL_MODE

                SQL_MODE =
                           STRICT_ALL_TABLES,                                                    Minimum
                                                                                               Recommended
                                                                                               Configuration
                           NO_ZERO_DATE,
                           NO_ZERO_IN_DATE,
                           NO_ENGINE_SUBSTITUTION;

                                             http://dev.mysql.com/doc/refman/5.5/en/server-sql-mode.html



                              EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Installation


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
installation

                           Current version is 5.5
                             http://dev.mysql.com/downloads/
                           RedHat current version is
                             5.0.77 - 28 JAN 2009
                           Ubuntu version is
                             5.1.44 - 04 FEB 2010
                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
UPDATES

                           MySQL is open source
                            More frequent updates
                            MySQL enterprise monthly updates
                            MySQL community ~ 6 months
                           Release notes
       http://dev.mysql.com/doc/refman/5.5/en/news-5-5-x.html

                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
installation

                           MySQL 5.5 via distro
                            Oracle has no yum repository
                              No immediate plans for community
                            Canonical (Ubuntu) has no ETA




                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
INSTALLATION

                           Recommendations
                             Use MySQL created rpms
                             Use MySQL Tar Binary
                           Issues
                             Dependencies
                             PHP/Perl etc
                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Auditing


                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Auditing options

                           Status variables
                           Binary log
                           Schema compare
                           Audit plugin (5.5)
                           Oracle Audit Vault


                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
STATUS variables
               mysql> SELECT variable_name, variable_value
                   -> FROM INFORMATION_SCHEMA.GLOBAL_STATUS
                   -> WHERE variable_name LIKE 'COM_ALTER%'
                   -> OR variable_name LIKE 'COM_DROP%'
                   -> OR variable_name LIKE 'COM_CREATE%';
               +----------------------+----------------+
               | variable_name        | variable_value |
               +----------------------+----------------+
               | COM_ALTER_DB         | 0               |
               | COM_ALTER_DB_UPGRADE | 0               |
               | COM_ALTER_EVENT      | 0               |
               | COM_ALTER_FUNCTION   | 0               |
               | COM_ALTER_PROCEDURE | 0                |
               | COM_ALTER_SERVER     | 0               |
               | COM_ALTER_TABLE      | 0               |
               | COM_ALTER_TABLESPACE | 0               |



                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
binary log
                 $ mysqlbinlog /path/to/file > binlog.txt
                 $ grep -ie ALTER -e CREATE -e DROP binlog.txt




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
schema
                 $ mysqldump -uroot -p 
                   --no-data --all-databases --skip-dump-date 
                   | sed -e "s/AUTO_INCREMENT=[^ ] //"
                   > schema.`date +%Y%M%D.%H%M`sql




                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Audit plugin

                           Auditing interface (5.5)
                            http://dev.mysql.com/doc/refman/5.5/en/audit-plugins.html




                                EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
TBD

                           Oracle Audit Vault




                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
conclusion

                           MySQL is not secure by default
                             Responsibility on you (DBA/SA)
                           Starts with OS security
                           Use appropriate privileges




                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
NOT Covered

                           Replication
                           SSL
                           Backups
                           SQL Injection
                             Sanitize your database inputs
                                                                      http://xkcd.com/327/

                                 EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
ReferEnces

                           Securing MySQL by Sheeri Cabral

                    http://sheeri.com/content/securing-mysql-and-how-be-rock-star-dba-pr




                               EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
References

                           OurSQL podcast
                            Episode 59: Security Blankets 1
                            Episode 61: Security Blankets 2
                            Episode 55: MySQL Data encryption


                                                                http://technocation.org/

                              EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Available NOW


  http://effectivemysql.com/book/optimizing-sql-statements/
                 EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Coming Soon

                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011
Ronald Bradford
                               http://effectiveMySQL.com
                           EffectiveMySQL.com - Its all about Performance and Scalability

Sunday, October 16, 2011

More Related Content

What's hot

MySQL For Oracle Developers
MySQL For Oracle DevelopersMySQL For Oracle Developers
MySQL For Oracle DevelopersRonald Bradford
 
MySQL Idiosyncrasies That Bite SF
MySQL Idiosyncrasies That Bite SFMySQL Idiosyncrasies That Bite SF
MySQL Idiosyncrasies That Bite SFRonald Bradford
 
What's New MySQL 8.0?
What's New MySQL 8.0?What's New MySQL 8.0?
What's New MySQL 8.0?OracleMySQL
 
MySQL 8.0.16 New Features Summary
MySQL 8.0.16 New Features SummaryMySQL 8.0.16 New Features Summary
MySQL 8.0.16 New Features SummaryOlivier DASINI
 
Testing mysql creatively in a sandbox
Testing mysql creatively in a sandboxTesting mysql creatively in a sandbox
Testing mysql creatively in a sandboxGiuseppe Maxia
 
MySQL 8.0.19 - New Features Summary
MySQL 8.0.19 - New Features SummaryMySQL 8.0.19 - New Features Summary
MySQL 8.0.19 - New Features SummaryOlivier DASINI
 
Mysql nowwhat
Mysql nowwhatMysql nowwhat
Mysql nowwhatsqlhjalp
 
MySQL 8.0.22 - New Features Summary
MySQL 8.0.22 - New Features SummaryMySQL 8.0.22 - New Features Summary
MySQL 8.0.22 - New Features SummaryOlivier DASINI
 
Coding For Config: Install Profile Development Using Features
Coding For Config: Install Profile Development Using FeaturesCoding For Config: Install Profile Development Using Features
Coding For Config: Install Profile Development Using FeaturesMyplanet Digital
 
A26 MariaDB : The New&Implemented MySQL Branch by Colin Charles
A26 MariaDB : The New&Implemented MySQL Branch by Colin CharlesA26 MariaDB : The New&Implemented MySQL Branch by Colin Charles
A26 MariaDB : The New&Implemented MySQL Branch by Colin CharlesInsight Technology, Inc.
 
Ansible is Our Wishbone(Automate DBA Tasks With Ansible)
Ansible is Our Wishbone(Automate DBA Tasks With Ansible)Ansible is Our Wishbone(Automate DBA Tasks With Ansible)
Ansible is Our Wishbone(Automate DBA Tasks With Ansible)M Malai
 
MySQL 8.0.17 - New Features Summary
MySQL 8.0.17 - New Features SummaryMySQL 8.0.17 - New Features Summary
MySQL 8.0.17 - New Features SummaryOlivier DASINI
 
MySQL 8.0.18 - New Features Summary
MySQL 8.0.18 - New Features SummaryMySQL 8.0.18 - New Features Summary
MySQL 8.0.18 - New Features SummaryOlivier DASINI
 
20161029 py con-mysq-lv3
20161029 py con-mysq-lv320161029 py con-mysq-lv3
20161029 py con-mysq-lv3Ivan Ma
 
2012.10.20 OSC 2012 Hiroshima
2012.10.20 OSC 2012 Hiroshima2012.10.20 OSC 2012 Hiroshima
2012.10.20 OSC 2012 HiroshimaRyusuke Kajiyama
 
My sql crashcourse_2012
My sql crashcourse_2012My sql crashcourse_2012
My sql crashcourse_2012sqlhjalp
 

What's hot (20)

Mastering VMware datacenter
Mastering VMware datacenterMastering VMware datacenter
Mastering VMware datacenter
 
MySQL For Oracle Developers
MySQL For Oracle DevelopersMySQL For Oracle Developers
MySQL For Oracle Developers
 
MySQL Idiosyncrasies That Bite SF
MySQL Idiosyncrasies That Bite SFMySQL Idiosyncrasies That Bite SF
MySQL Idiosyncrasies That Bite SF
 
What's New MySQL 8.0?
What's New MySQL 8.0?What's New MySQL 8.0?
What's New MySQL 8.0?
 
MySQL 8.0.16 New Features Summary
MySQL 8.0.16 New Features SummaryMySQL 8.0.16 New Features Summary
MySQL 8.0.16 New Features Summary
 
Testing mysql creatively in a sandbox
Testing mysql creatively in a sandboxTesting mysql creatively in a sandbox
Testing mysql creatively in a sandbox
 
Introduction Mysql
Introduction Mysql Introduction Mysql
Introduction Mysql
 
MySQL 8.0.19 - New Features Summary
MySQL 8.0.19 - New Features SummaryMySQL 8.0.19 - New Features Summary
MySQL 8.0.19 - New Features Summary
 
Mysql nowwhat
Mysql nowwhatMysql nowwhat
Mysql nowwhat
 
MySQL 8.0.22 - New Features Summary
MySQL 8.0.22 - New Features SummaryMySQL 8.0.22 - New Features Summary
MySQL 8.0.22 - New Features Summary
 
Coding For Config: Install Profile Development Using Features
Coding For Config: Install Profile Development Using FeaturesCoding For Config: Install Profile Development Using Features
Coding For Config: Install Profile Development Using Features
 
A26 MariaDB : The New&Implemented MySQL Branch by Colin Charles
A26 MariaDB : The New&Implemented MySQL Branch by Colin CharlesA26 MariaDB : The New&Implemented MySQL Branch by Colin Charles
A26 MariaDB : The New&Implemented MySQL Branch by Colin Charles
 
Ansible is Our Wishbone(Automate DBA Tasks With Ansible)
Ansible is Our Wishbone(Automate DBA Tasks With Ansible)Ansible is Our Wishbone(Automate DBA Tasks With Ansible)
Ansible is Our Wishbone(Automate DBA Tasks With Ansible)
 
MySQL 8.0.17 - New Features Summary
MySQL 8.0.17 - New Features SummaryMySQL 8.0.17 - New Features Summary
MySQL 8.0.17 - New Features Summary
 
MySQL 8.0.18 - New Features Summary
MySQL 8.0.18 - New Features SummaryMySQL 8.0.18 - New Features Summary
MySQL 8.0.18 - New Features Summary
 
20161029 py con-mysq-lv3
20161029 py con-mysq-lv320161029 py con-mysq-lv3
20161029 py con-mysq-lv3
 
2012.10.20 OSC 2012 Hiroshima
2012.10.20 OSC 2012 Hiroshima2012.10.20 OSC 2012 Hiroshima
2012.10.20 OSC 2012 Hiroshima
 
My sql crashcourse_2012
My sql crashcourse_2012My sql crashcourse_2012
My sql crashcourse_2012
 
VMWare Lab For Training, Testing or Proof of Concept
VMWare Lab For Training, Testing or Proof of ConceptVMWare Lab For Training, Testing or Proof of Concept
VMWare Lab For Training, Testing or Proof of Concept
 
Replication 101
Replication 101Replication 101
Replication 101
 

Viewers also liked

MySQL administration in Amazon RDS
MySQL administration in Amazon RDSMySQL administration in Amazon RDS
MySQL administration in Amazon RDSPythian
 
MySQL GUI Administration
MySQL GUI AdministrationMySQL GUI Administration
MySQL GUI AdministrationJaime Crespo
 
Percona Toolkit for Effective MySQL Administration
Percona Toolkit for Effective MySQL AdministrationPercona Toolkit for Effective MySQL Administration
Percona Toolkit for Effective MySQL AdministrationMydbops
 
MySQL Monitoring Shoot Out
MySQL Monitoring Shoot OutMySQL Monitoring Shoot Out
MySQL Monitoring Shoot OutKris Buytaert
 
MySQL Slow Query log Monitoring using Beats & ELK
MySQL Slow Query log Monitoring using Beats & ELKMySQL Slow Query log Monitoring using Beats & ELK
MySQL Slow Query log Monitoring using Beats & ELKYoungHeon (Roy) Kim
 
Monitoring your technology stack with New Relic
Monitoring your technology stack with New RelicMonitoring your technology stack with New Relic
Monitoring your technology stack with New RelicRonald Bradford
 
MySQL Monitoring with Zabbix
MySQL Monitoring with ZabbixMySQL Monitoring with Zabbix
MySQL Monitoring with ZabbixFromDual GmbH
 
MySQL Administration and Monitoring
MySQL Administration and MonitoringMySQL Administration and Monitoring
MySQL Administration and MonitoringMark Leith
 
Mysql Explain Explained
Mysql Explain ExplainedMysql Explain Explained
Mysql Explain ExplainedJeremy Coates
 

Viewers also liked (12)

MySQL administration in Amazon RDS
MySQL administration in Amazon RDSMySQL administration in Amazon RDS
MySQL administration in Amazon RDS
 
MySQL GUI Administration
MySQL GUI AdministrationMySQL GUI Administration
MySQL GUI Administration
 
Percona Toolkit for Effective MySQL Administration
Percona Toolkit for Effective MySQL AdministrationPercona Toolkit for Effective MySQL Administration
Percona Toolkit for Effective MySQL Administration
 
MySQL Monitoring Shoot Out
MySQL Monitoring Shoot OutMySQL Monitoring Shoot Out
MySQL Monitoring Shoot Out
 
MySQL Slow Query log Monitoring using Beats & ELK
MySQL Slow Query log Monitoring using Beats & ELKMySQL Slow Query log Monitoring using Beats & ELK
MySQL Slow Query log Monitoring using Beats & ELK
 
MySQL Monitoring 101
MySQL Monitoring 101MySQL Monitoring 101
MySQL Monitoring 101
 
MySQL DBA
MySQL DBAMySQL DBA
MySQL DBA
 
Monitoring your technology stack with New Relic
Monitoring your technology stack with New RelicMonitoring your technology stack with New Relic
Monitoring your technology stack with New Relic
 
MySQL Monitoring with Zabbix
MySQL Monitoring with ZabbixMySQL Monitoring with Zabbix
MySQL Monitoring with Zabbix
 
MySQL Administration and Monitoring
MySQL Administration and MonitoringMySQL Administration and Monitoring
MySQL Administration and Monitoring
 
Mysql Explain Explained
Mysql Explain ExplainedMysql Explain Explained
Mysql Explain Explained
 
How to Monitor MySQL
How to Monitor MySQLHow to Monitor MySQL
How to Monitor MySQL
 

Similar to [INSIGHT OUT 2011] B12 better my sql security and administration(ronald)

[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)
[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)
[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)Insight Technology, Inc.
 
Posscon my sql56
Posscon my sql56Posscon my sql56
Posscon my sql56Dave Stokes
 
Keith Larson Replication
Keith Larson ReplicationKeith Larson Replication
Keith Larson ReplicationDave Stokes
 
What's New in MySQL 5.6
What's New in MySQL 5.6What's New in MySQL 5.6
What's New in MySQL 5.6Santo Leto
 
UKOUG 2011: MySQL Architectures for Oracle DBA's
UKOUG 2011: MySQL Architectures for Oracle DBA'sUKOUG 2011: MySQL Architectures for Oracle DBA's
UKOUG 2011: MySQL Architectures for Oracle DBA'sFromDual GmbH
 
My sql crashcourse_intro_kdl
My sql crashcourse_intro_kdlMy sql crashcourse_intro_kdl
My sql crashcourse_intro_kdlsqlhjalp
 
newsql-intro.ppt
newsql-intro.pptnewsql-intro.ppt
newsql-intro.pptsjukic
 
MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15
MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15
MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15Dave Stokes
 
The History and Future of the MySQL ecosystem
The History and Future of the MySQL ecosystemThe History and Future of the MySQL ecosystem
The History and Future of the MySQL ecosystemRonald Bradford
 
MySQL update SCaLE 2012
MySQL update SCaLE 2012MySQL update SCaLE 2012
MySQL update SCaLE 2012Dave Stokes
 
My First 100 days with a MySQL DBMS (WP)
My First 100 days with a MySQL DBMS (WP)My First 100 days with a MySQL DBMS (WP)
My First 100 days with a MySQL DBMS (WP)Gustavo Rene Antunez
 
MySQL 8: Ready for Prime Time
MySQL 8: Ready for Prime TimeMySQL 8: Ready for Prime Time
MySQL 8: Ready for Prime TimeArnab Ray
 
Case study on mysql in rdbms
Case study on mysql in rdbmsCase study on mysql in rdbms
Case study on mysql in rdbmsRajalakshmiK19
 
Technology Day 2011 MySQL & MariaDB
Technology Day 2011 MySQL & MariaDBTechnology Day 2011 MySQL & MariaDB
Technology Day 2011 MySQL & MariaDBDan-Claudiu Dragoș
 
What's new in my sql smug
What's new in my sql smugWhat's new in my sql smug
What's new in my sql smugTed Wennmark
 
MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017
MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017
MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017Ivan Ma
 
Scaling MySQL -- Swanseacon.co.uk
Scaling MySQL -- Swanseacon.co.uk Scaling MySQL -- Swanseacon.co.uk
Scaling MySQL -- Swanseacon.co.uk Dave Stokes
 
MySQL InnoDB Cluster and NDB Cluster
MySQL InnoDB Cluster and NDB ClusterMySQL InnoDB Cluster and NDB Cluster
MySQL InnoDB Cluster and NDB ClusterMario Beck
 

Similar to [INSIGHT OUT 2011] B12 better my sql security and administration(ronald) (20)

[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)
[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)
[INSIGHT OUT 2011] A17 mastering my sql performance tuning(ronald bradford)
 
Posscon my sql56
Posscon my sql56Posscon my sql56
Posscon my sql56
 
Keith Larson Replication
Keith Larson ReplicationKeith Larson Replication
Keith Larson Replication
 
What's New in MySQL 5.6
What's New in MySQL 5.6What's New in MySQL 5.6
What's New in MySQL 5.6
 
UKOUG 2011: MySQL Architectures for Oracle DBA's
UKOUG 2011: MySQL Architectures for Oracle DBA'sUKOUG 2011: MySQL Architectures for Oracle DBA's
UKOUG 2011: MySQL Architectures for Oracle DBA's
 
My sql crashcourse_intro_kdl
My sql crashcourse_intro_kdlMy sql crashcourse_intro_kdl
My sql crashcourse_intro_kdl
 
newsql-intro.ppt
newsql-intro.pptnewsql-intro.ppt
newsql-intro.ppt
 
MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15
MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15
MySQL for Oracle DBA -- Rocky Mountain Oracle User Group Training Days '15
 
20111121 osi keynote
20111121 osi keynote20111121 osi keynote
20111121 osi keynote
 
The History and Future of the MySQL ecosystem
The History and Future of the MySQL ecosystemThe History and Future of the MySQL ecosystem
The History and Future of the MySQL ecosystem
 
MySQL update SCaLE 2012
MySQL update SCaLE 2012MySQL update SCaLE 2012
MySQL update SCaLE 2012
 
My First 100 days with a MySQL DBMS (WP)
My First 100 days with a MySQL DBMS (WP)My First 100 days with a MySQL DBMS (WP)
My First 100 days with a MySQL DBMS (WP)
 
MySQL 8: Ready for Prime Time
MySQL 8: Ready for Prime TimeMySQL 8: Ready for Prime Time
MySQL 8: Ready for Prime Time
 
Case study on mysql in rdbms
Case study on mysql in rdbmsCase study on mysql in rdbms
Case study on mysql in rdbms
 
Technology Day 2011 MySQL & MariaDB
Technology Day 2011 MySQL & MariaDBTechnology Day 2011 MySQL & MariaDB
Technology Day 2011 MySQL & MariaDB
 
What's new in my sql smug
What's new in my sql smugWhat's new in my sql smug
What's new in my sql smug
 
MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017
MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017
MySQL InnoDB Cluster and MySQL Group Replication @HKOSC 2017
 
Scaling MySQL -- Swanseacon.co.uk
Scaling MySQL -- Swanseacon.co.uk Scaling MySQL -- Swanseacon.co.uk
Scaling MySQL -- Swanseacon.co.uk
 
MySQL InnoDB Cluster and NDB Cluster
MySQL InnoDB Cluster and NDB ClusterMySQL InnoDB Cluster and NDB Cluster
MySQL InnoDB Cluster and NDB Cluster
 
Simple Way for MySQL to NoSQL
Simple Way for MySQL to NoSQLSimple Way for MySQL to NoSQL
Simple Way for MySQL to NoSQL
 

More from Insight Technology, Inc.

グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?Insight Technology, Inc.
 
Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~
Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~
Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~Insight Technology, Inc.
 
事例を通じて機械学習とは何かを説明する
事例を通じて機械学習とは何かを説明する事例を通じて機械学習とは何かを説明する
事例を通じて機械学習とは何かを説明するInsight Technology, Inc.
 
仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーン
仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーン仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーン
仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーンInsight Technology, Inc.
 
MBAAで覚えるDBREの大事なおしごと
MBAAで覚えるDBREの大事なおしごとMBAAで覚えるDBREの大事なおしごと
MBAAで覚えるDBREの大事なおしごとInsight Technology, Inc.
 
グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?Insight Technology, Inc.
 
DBREから始めるデータベースプラットフォーム
DBREから始めるデータベースプラットフォームDBREから始めるデータベースプラットフォーム
DBREから始めるデータベースプラットフォームInsight Technology, Inc.
 
SQL Server エンジニアのためのコンテナ入門
SQL Server エンジニアのためのコンテナ入門SQL Server エンジニアのためのコンテナ入門
SQL Server エンジニアのためのコンテナ入門Insight Technology, Inc.
 
db tech showcase2019オープニングセッション @ 森田 俊哉
db tech showcase2019オープニングセッション @ 森田 俊哉 db tech showcase2019オープニングセッション @ 森田 俊哉
db tech showcase2019オープニングセッション @ 森田 俊哉 Insight Technology, Inc.
 
db tech showcase2019 オープニングセッション @ 石川 雅也
db tech showcase2019 オープニングセッション @ 石川 雅也db tech showcase2019 オープニングセッション @ 石川 雅也
db tech showcase2019 オープニングセッション @ 石川 雅也Insight Technology, Inc.
 
db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー
db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー
db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー Insight Technology, Inc.
 
難しいアプリケーション移行、手軽に試してみませんか?
難しいアプリケーション移行、手軽に試してみませんか?難しいアプリケーション移行、手軽に試してみませんか?
難しいアプリケーション移行、手軽に試してみませんか?Insight Technology, Inc.
 
Attunityのソリューションと異種データベース・クラウド移行事例のご紹介
Attunityのソリューションと異種データベース・クラウド移行事例のご紹介Attunityのソリューションと異種データベース・クラウド移行事例のご紹介
Attunityのソリューションと異種データベース・クラウド移行事例のご紹介Insight Technology, Inc.
 
そのデータベース、クラウドで使ってみませんか?
そのデータベース、クラウドで使ってみませんか?そのデータベース、クラウドで使ってみませんか?
そのデータベース、クラウドで使ってみませんか?Insight Technology, Inc.
 
コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...
コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...
コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...Insight Technology, Inc.
 
複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。
複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。 複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。
複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。 Insight Technology, Inc.
 
Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...
Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...
Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...Insight Technology, Inc.
 
レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]
レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]
レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]Insight Technology, Inc.
 

More from Insight Technology, Inc. (20)

グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?
 
Docker and the Oracle Database
Docker and the Oracle DatabaseDocker and the Oracle Database
Docker and the Oracle Database
 
Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~
Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~
Great performance at scale~次期PostgreSQL12のパーティショニング性能の実力に迫る~
 
事例を通じて機械学習とは何かを説明する
事例を通じて機械学習とは何かを説明する事例を通じて機械学習とは何かを説明する
事例を通じて機械学習とは何かを説明する
 
仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーン
仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーン仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーン
仮想通貨ウォレットアプリで理解するデータストアとしてのブロックチェーン
 
MBAAで覚えるDBREの大事なおしごと
MBAAで覚えるDBREの大事なおしごとMBAAで覚えるDBREの大事なおしごと
MBAAで覚えるDBREの大事なおしごと
 
グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?グラフデータベースは如何に自然言語を理解するか?
グラフデータベースは如何に自然言語を理解するか?
 
DBREから始めるデータベースプラットフォーム
DBREから始めるデータベースプラットフォームDBREから始めるデータベースプラットフォーム
DBREから始めるデータベースプラットフォーム
 
SQL Server エンジニアのためのコンテナ入門
SQL Server エンジニアのためのコンテナ入門SQL Server エンジニアのためのコンテナ入門
SQL Server エンジニアのためのコンテナ入門
 
Lunch & Learn, AWS NoSQL Services
Lunch & Learn, AWS NoSQL ServicesLunch & Learn, AWS NoSQL Services
Lunch & Learn, AWS NoSQL Services
 
db tech showcase2019オープニングセッション @ 森田 俊哉
db tech showcase2019オープニングセッション @ 森田 俊哉 db tech showcase2019オープニングセッション @ 森田 俊哉
db tech showcase2019オープニングセッション @ 森田 俊哉
 
db tech showcase2019 オープニングセッション @ 石川 雅也
db tech showcase2019 オープニングセッション @ 石川 雅也db tech showcase2019 オープニングセッション @ 石川 雅也
db tech showcase2019 オープニングセッション @ 石川 雅也
 
db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー
db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー
db tech showcase2019 オープニングセッション @ マイナー・アレン・パーカー
 
難しいアプリケーション移行、手軽に試してみませんか?
難しいアプリケーション移行、手軽に試してみませんか?難しいアプリケーション移行、手軽に試してみませんか?
難しいアプリケーション移行、手軽に試してみませんか?
 
Attunityのソリューションと異種データベース・クラウド移行事例のご紹介
Attunityのソリューションと異種データベース・クラウド移行事例のご紹介Attunityのソリューションと異種データベース・クラウド移行事例のご紹介
Attunityのソリューションと異種データベース・クラウド移行事例のご紹介
 
そのデータベース、クラウドで使ってみませんか?
そのデータベース、クラウドで使ってみませんか?そのデータベース、クラウドで使ってみませんか?
そのデータベース、クラウドで使ってみませんか?
 
コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...
コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...
コモディティサーバー3台で作る高速処理 “ハイパー・コンバージド・データベース・インフラストラクチャー(HCDI)” システム『Insight Qube』...
 
複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。
複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。 複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。
複数DBのバックアップ・切り戻し運用手順が異なって大変?!運用性の大幅改善、その先に。。
 
Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...
Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...
Attunity社のソリューションの日本国内外適用事例及びロードマップ紹介[ATTUNITY & インサイトテクノロジー IoT / Big Data フ...
 
レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]
レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]
レガシーに埋もれたデータをリアルタイムでクラウドへ [ATTUNITY & インサイトテクノロジー IoT / Big Data フォーラム 2018]
 

Recently uploaded

Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Paola De la Torre
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...HostedbyConfluent
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Allon Mureinik
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxOnBoard
 
Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksSoftradix Technologies
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Azure Monitor & Application Insight to monitor Infrastructure & Application
Azure Monitor & Application Insight to monitor Infrastructure & ApplicationAzure Monitor & Application Insight to monitor Infrastructure & Application
Azure Monitor & Application Insight to monitor Infrastructure & ApplicationAndikSusilo4
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxKatpro Technologies
 
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphNeo4j
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhisoniya singh
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 

Recently uploaded (20)

Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptx
 
Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other Frameworks
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Azure Monitor & Application Insight to monitor Infrastructure & Application
Azure Monitor & Application Insight to monitor Infrastructure & ApplicationAzure Monitor & Application Insight to monitor Infrastructure & Application
Azure Monitor & Application Insight to monitor Infrastructure & Application
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
 
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 

[INSIGHT OUT 2011] B12 better my sql security and administration(ronald)

  • 1. Title EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 2. Title Better MySQL Security and Administration Ronald Bradford http://ronaldbradford.com Insight Out DB Showcase October 2011 EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 3. OBJECTIVE Identify MySQL security issues Improve MySQL installation process Identify data issues Improve data integrity and security Auditing options EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 4. ABOUT AUTHOR Ronald BRADFORD 12 years with MySQL / 22 years with RDBMS Senior Consultant at MySQL Inc (06-08) Consultant for Oracle Corporation (96-99) 7 years presenting MySQL content All time top MySQL blogger Available NOW Published author for consulting Oracle ACE Director http://RonaldBradford.com EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 5. MySQL Security EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 6. install security Default is woeful Minimum $ mysql_secure_installation Recommended Operating System Permissions & Privileges EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 7. Hacking MySQL EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 8. Hacking MySQL 1 $ mysql -uroot For a default MySQL installation, there is no password for super user account EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 9. Hacking MySQL 2 $ mysql mysql> USE test For a default MySQL installation, there is anonymous access. More on this soon! EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 10. Hacking MySQL 3 $ sudo su - $ mysql $ cat ~/.my.cnf [client] Many host providers have the user=root superuser password in the default user config file password=XXX # Other users with logins $ find / -name ".my.cnf" EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 11. Hacking MySQL 4 $ grep mysql $HOME/.*history $ grep mysql /home/*/.*history Shell commands leave an audit history. If password is specified on command line, it is in history EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 12. Hacking MySQL 5 $ mysql -u<some not privileged user> mysql> SELECT host,user,password FROM mysql.user; +--------------+------+----------+ | host | user | password | +--------------+------+----------+ | localhost | root | | | mactaz.local | root | | | 127.0.0.1 | root | | | ::1 | root | | | localhost | | | | mactaz.local | | Can you view MySQL privileges to | +--------------+------+----------+ find a user with more access? EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 13. Hacking MySQL 6 $ cd [mysql-data-dir] # e.g. /var/lib/mysql $ cat master.info 15 mysql-bin.001536 20160154 10.0.0.1 repl XXX 3306 60 $ mysql -urepl -pXXX -h10.0.0.1 mysql> SHOW GRANTS; Are datadir permissions secure? Does replication connection have global permissions? EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 14. Hacking MySQL 7 $ cd [mysql-data-dir] # e.g. /var/lib/mysql $ strings mysql/user.MYD ... dba*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 mysql> SELECT 'password',PASSWORD('password'); +----------+-------------------------------------------+ | password | PASSWORD('password') | +----------+-------------------------------------------+ | password | *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 | +----------+-------------------------------------------+ mysql> SELECT 'passwd',PASSWORD('passwd'); +--------+-------------------------------------------+ | passwd | PASSWORD('passwd') | +--------+-------------------------------------------+ | passwd | *59C70DA2F3E3A5BDF46B68F5C8B8F25762BCCEF0 | +--------+-------------------------------------------+ Is datadir permissions secure? Can list all users and password hash EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 15. Hacking MySQL mysql> CREATE SCHEMA IF NOT EXISTS hack; 7a mysql> use hack; mysql> CREATE TABLE words(word VARCHAR(100)); mysql> LOAD DATA LOCAL INFILE '/tmp/passwords' -> INTO TABLE words(word); mysql -uroot -e "SELECT word,PASSWORD(word) FROM hack.words" --skip-column-names > /tmp/mysql-passwords $ cat /tmp/mysql-passwords password *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 passwd *59C70DA2F3E3A5BDF46B68F5C8B8F25762BCCEF0 oracle *2447D497B9A6A15F2776055CB2D1E9F86758182F changeme *7ACE763ED393514FE0C162B93996ECD195FFC4F5 xxx *3D56A309CD04FA2EEF181462E59011F075C89548 Brute force checking EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 16. Hacking MySQL 8 $ mysqld --skip-grant-tables $ mysql -uroot mysql> UPDATE mysql.user -> SET password=PASSWORD('hacked'); mysql> FLUSH PRIVILEGES; If access to start and stop mysqld process, you can reset passwords. EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 17. Hacking MySQL 9 $ cat wordpress/wp-config.php $ cat drupal/sites/default/settings.php # Insert your application here Applications with cleartext passwords and user may have excessive privileges EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 18. Denial of Service (DOS) EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 19. Breaking MySQL $ mysql mysql> USE test mysql> CREATE TABLE filldisk(c VARCHAR(1000)); mysql> INSERT INTO filldisk VALUES(REPEAT('x',1000)),(REPEAT('y',1000)), (REPEAT('z',1000)); mysql> INSERT INTO filldisk SELECT a.c FROM filldisk a, filldisk b, filldisk c, filldisk d, filldisk e; Query OK, 243 rows affected (0.05 sec) mysql> INSERT INTO filldisk SELECT a.c FROM filldisk a, filldisk b, filldisk c, filldisk d, filldisk e; Will it end? mysql> SELECT POW(3,5); +----------+ | pow(3,5) | +----------+ | 243 | +----------+ mysql> SELECT POW(243,5); +-----------------+ | pow(243,5) | +-----------------+ | 847,288,609,443 | Anonymous access. EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 20. Breaking MYSQL # Steal CPU cycles mysql> SELECT MD5(a.c), MD5(b.c) -> FROM filldisk a, filldisk b ORDER BY RAND(); EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 21. BREAKING MYSQL # Force disk I/O mysql> SET SESSION tmp_table_size=1024*4; # 4K mysql> SELECT ... EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 22. install security $ mysql_secure_installation Remove anonymous users Remove test database Remove non ‘localhost’ root users Set root password EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 23. OS Security EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 24. OS Security Defaults are not always secure Separate Data/Binary Logs/Logs/ Configuration/Backups Individual directory permissions Never run mysqld as 'root' user • Minimize security risk • Better auditability EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 25. Data security $ ls -ld /var/lib/mysql drwxr-xr-x 6 mysql mysql 4096 Oct 13 16:45 /var/lib/mysql $ ls -l /var/lib/mysql total 3749488 drwx------ 2 mysql mysql 4096 Oct 6 18:50 db1 drwx------ 2 mysql mysql 4096 Jun 6 14:11 db2 -rw-rw---- 1 mysql mysql 3298820096 Oct 16 20:42 ibdata1 -rw-rw---- 1 mysql mysql 268435456 Oct 16 20:42 ib_logfile0 -rw-rw---- 1 mysql mysql 268435456 Oct 16 20:42 ib_logfile1 drwx------ 2 mysql mysql 4096 Jun 6 09:37 mysql srwxrwxrwx 1 mysql mysql 0 Oct 12 20:09 mysql.sock Change default configuration for socket=/var/run/mysql/mysql.sock EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 26. Installation Best Practice Single partition per MySQL Instance /mysql Global files as symlinks /etc from partition /data /binlog /etc/my.cnf /log /etc/profile.d/mysql.sh /etc/init.d/mysqld /mysql-version EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 27. Installation Software installed by root Separate MySQL permissions for directories $ chown -R root:root /mysql $ chown -R mysql:mysql /mysql/{data,log,binlog,etc} $ chmod 700 /mysql/{data,binlog} $ chmod 750 /mysql/{etc,log} EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 28. NETWORK MySQL listens on one TCP/IP port Default port is 3306 --skip-networking disables TCP/IP Database does not require physical web access generally Firewall management EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 29. User Privileges EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 30. User Privileges Best Practice CREATE USER goodguy@localhost IDENTIFIED BY 'sakila'; GRANT CREATE,SELECT,INSERT,UPDATE,DELETE ON db.* TO ✔ goodguy@localhost; Normal Practice CREATE USER superman@'%'; GRANT ALL ON *.* TO superman@'%'; ✘ http://dev.mysql.com/doc/refman/5.5/en/create-user.html http://dev.mysql.com/doc/refman/5.5/en/grant.html EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 31. GRANT ALL ON *.* GRANT ALL ON *.* TO user@’%’ *.* gives you access to all tables in all schemas @’%’ give you access from any external location ALL gives you ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE USER, CREATE VIEW, DELETE, DROP, EVENT, EXECUTE, FILE, INDEX, INSERT, LOCK TABLES, PROCESS, REFERENCES, RELOAD, REPLICATION CLIENT, REPLICATION SLAVE, SELECT, SHOW DATABASES, SHOW VIEW, SHUTDOWN, SUPER, TRIGGER, UPDATE, USAGE EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 32. SUPER SUPER Bypasses read_only Bypasses init_connect Can Disable binary logging Change configuration dynamically No reserved connection EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 33. SUPER/Read Only $ mysql -ugoodguy -psakila db mysql> insert into test1(id) values(1); ERROR 1290 (HY000): The MySQL server is running with the --read-only option so it cannot execute this statement ✔ $ mysql -usuperman db mysql> insert into test1(id) values(1); Query OK, 1 row affected (0.01 sec) ✘ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 34. SUPER / Connect #my.cnf [client] init_connect=SET NAMES utf8 This specifies to use UTF8 for communication with client and data EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 35. Super / connect EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 36. Super / connect ✔ $ mysql -ugoodguy -psakila db mysql> SHOW SESSION VARIABLES LIKE 'ch%'; +--------------------------+----------+ | Variable_name | Value | +--------------------------+----------+ | character_set_client | utf8 | | character_set_connection | utf8 | | character_set_database | latin1 | | character_set_filesystem | binary | | character_set_results | utf8 | | character_set_server | latin1 | | character_set_system | utf8 | +--------------------------+----------+ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 37. Super / connect ✔ $ mysql -usuperman db $ mysql -ugoodguy -psakila db ✘ mysql> SHOW SESSION VARIABLES LIKE mysql> SHOW SESSION VARIABLES LIKE 'ch%'; 'character%'; +--------------------------+----------+ +--------------------------+----------+ | Variable_name | Value | Variable_name| | Value | +--------------------------+----------+ +--------------------------+----------+ | character_set_client | character_set_client | utf8 | | latin1 | | character_set_connection | utf8 | | character_set_connection | latin1 | | character_set_database character_set_database | | latin1 | | latin1 | | character_set_filesystem | binary | | character_set_filesystem | binary | | character_set_results | character_set_results | utf8 | | latin1 | | character_set_server | character_set_server | latin1 | | latin1 | | character_set_system | character_set_system | utf8 | | utf8 | +--------------------------+----------+ +--------------------------+----------+ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 38. SUPER/Binary Log mysql> SHOW MASTER STATUS; +-------------------+----------+--------------+------------------+ | File | Position | Binlog_Do_DB | Binlog_Ignore_DB | +-------------------+----------+--------------+------------------+ | binary-log.000001 | 354 | | | +-------------------+----------+--------------+------------------+ 1 mysql> INSERT INTO account VALUES (9,'New',100); mysql> SET SQL_LOG_BIN=0; mysql> UPDATE account SET balance=1,000 WHERE id=9; 2 mysql> SET SQL_LOG_BIN=1; mysql> UPDATE balance SET balance = balance - 50 WHERE id=9; 3 mysql> SHOW MASTER STATUS; +-------------------+----------+--------------+------------------+ | File | Position | Binlog_Do_DB | Binlog_Ignore_DB | +-------------------+----------+--------------+------------------+ | binary-log.000001 | 674 | | | +-------------------+----------+--------------+------------------+ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 39. SUPER and Binary Log (2) $ mysqlbinlog binary-log.000001 --start-position=354 --stop-position=674 # at 354 #100604 18:00:08 server id 1 end_log_pos 450 Query thread_id=1 exec_time=0 error_code=0 use mysql/*!*/; SET TIMESTAMP=1275688808/*!*/; 1 ✘ INSERT INTO account VALUES (9,'New',100); /*!*/; # at 579 #100604 18:04:31 server id 1 end_log_pos 674 Query thread_id=2 exec_time=0 error_code=0 use mysql/*!*/; SET TIMESTAMP=1275689071/*!*/; mysql> UPDATE balance SET balance = balance - 50 WHERE id=9; 3 /*!*/; DELIMITER ; # End of log file ROLLBACK /* added by mysqlbinlog */; EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 40. SUPER/Connection $ mysql -uroot ✔ mysql> show global variables like 'max_connections'; +-----------------+-------+ | Variable_name | Value | +-----------------+-------+ | max_connections | 3 | +-----------------+-------+ 1 row in set (0.07 sec) mysql> show global status like 'threads_connected'; +-------------------+-------+ | Variable_name | Value | +-------------------+-------+ | Threads_connected | 4 | +-------------------+-------+ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 41. Super/Connection $ mysql -uroot mysql> SHOW PROCESSLIST; +----+------+-----------+-------+---------+------+------------+--------------- ✔ | Id | User | Host | db | Command | Time | State | Info +----+------+-----------+-------+---------+------+------------+--------------- | 13 | root | localhost | db1 | Query | 144 | User sleep | UPDATE test1 ... | 14 | root | localhost | db1 | Query | 116 | Locked | select * from test1 | 15 | root | localhost | db1 | Query | 89 | Locked | select * from test1 mysql> KILL THREAD 13; $ mysql -uroot ERROR 1040 (HY000): Too many connections ✘ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 42. Application users • Track Data Security • Separation of responsibilities Application Viewer (Read Only Access) SELECT Application User (Read/Write Access) INSERT, UPDATE, DELETE, SELECT Application DBA (Schema Access Only) CREATE, DROP, CREATE ROUTINE, SELECT, INSERT, UPDATE, DELETE, ... EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 43. securich ACL User privilege via roles http://securich.com Open source third party package EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 44. New features User authentication interface (5.5) http://dev.mysql.com/doc/refman/5.5/en/authentication-plugins.html PAM/LDAP Authentication (5.6 Enterprise) http://blogs.oracle.com/MySQL/entry/new_commercial_extensions_for_mysql http://blogs.oracle.com/mysql_joro/entry/mysql_55_brings_in_new_ways_to_authenticate_users EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 45. Data Integrity EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 46. Data Integrity CREATE TABLE sample_data ( i TINYINT UNSIGNED NOT NULL, ✔ c CHAR(2) NULL, t TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ) ENGINE=InnoDB DEFAULT CHARSET latin1; INSERT INTO sample_data(i) VALUES (0), (100), (255); Query OK, 3 rows affected (0.00 sec) SELECT * FROM sample_data; +-----+------+---------------------+ | i | c | t | +-----+------+---------------------+ | 0 | NULL | 2010-06-06 13:28:44 | | 100 | NULL | 2010-06-06 13:28:44 | | 255 | NULL | 2010-06-06 13:28:44 | +-----+------+---------------------+ 3 rows in set (0.00 sec) EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 47. Data Integrity mysql> INSERT INTO sample_data (i) VALUES (-1), (9000); ✘ mysql> SELECT * FROM sample_data; +-----+------+---------------------+ | i | c | t | +-----+------+---------------------+ | 0 | NULL | 2010-06-06 13:28:44 | | 100 | NULL | 2010-06-06 13:28:44 | | 255 | NULL | 2010-06-06 13:28:44 | | 0 | NULL | 2010-06-06 13:32:52 | | 255 | NULL | 2010-06-06 13:32:52 | +-----+------+---------------------+ 5 rows in set (0.01 sec) Data In != Data out EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 48. SQL_MODE SQL_MODE = STRICT_ALL_TABLES, Minimum Recommended Configuration NO_ZERO_DATE, NO_ZERO_IN_DATE, NO_ENGINE_SUBSTITUTION; http://dev.mysql.com/doc/refman/5.5/en/server-sql-mode.html EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 49. Installation EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 50. installation Current version is 5.5 http://dev.mysql.com/downloads/ RedHat current version is 5.0.77 - 28 JAN 2009 Ubuntu version is 5.1.44 - 04 FEB 2010 EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 51. UPDATES MySQL is open source More frequent updates MySQL enterprise monthly updates MySQL community ~ 6 months Release notes http://dev.mysql.com/doc/refman/5.5/en/news-5-5-x.html EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 52. installation MySQL 5.5 via distro Oracle has no yum repository No immediate plans for community Canonical (Ubuntu) has no ETA EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 53. INSTALLATION Recommendations Use MySQL created rpms Use MySQL Tar Binary Issues Dependencies PHP/Perl etc EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 54. Auditing EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 55. Auditing options Status variables Binary log Schema compare Audit plugin (5.5) Oracle Audit Vault EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 56. STATUS variables mysql> SELECT variable_name, variable_value -> FROM INFORMATION_SCHEMA.GLOBAL_STATUS -> WHERE variable_name LIKE 'COM_ALTER%' -> OR variable_name LIKE 'COM_DROP%' -> OR variable_name LIKE 'COM_CREATE%'; +----------------------+----------------+ | variable_name | variable_value | +----------------------+----------------+ | COM_ALTER_DB | 0 | | COM_ALTER_DB_UPGRADE | 0 | | COM_ALTER_EVENT | 0 | | COM_ALTER_FUNCTION | 0 | | COM_ALTER_PROCEDURE | 0 | | COM_ALTER_SERVER | 0 | | COM_ALTER_TABLE | 0 | | COM_ALTER_TABLESPACE | 0 | EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 57. binary log $ mysqlbinlog /path/to/file > binlog.txt $ grep -ie ALTER -e CREATE -e DROP binlog.txt EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 58. schema $ mysqldump -uroot -p --no-data --all-databases --skip-dump-date | sed -e "s/AUTO_INCREMENT=[^ ] //" > schema.`date +%Y%M%D.%H%M`sql EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 59. Audit plugin Auditing interface (5.5) http://dev.mysql.com/doc/refman/5.5/en/audit-plugins.html EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 60. TBD Oracle Audit Vault EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 61. conclusion MySQL is not secure by default Responsibility on you (DBA/SA) Starts with OS security Use appropriate privileges EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 62. NOT Covered Replication SSL Backups SQL Injection Sanitize your database inputs http://xkcd.com/327/ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 63. ReferEnces Securing MySQL by Sheeri Cabral http://sheeri.com/content/securing-mysql-and-how-be-rock-star-dba-pr EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 64. References OurSQL podcast Episode 59: Security Blankets 1 Episode 61: Security Blankets 2 Episode 55: MySQL Data encryption http://technocation.org/ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 65. Available NOW http://effectivemysql.com/book/optimizing-sql-statements/ EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 66. Coming Soon EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011
  • 67. Ronald Bradford http://effectiveMySQL.com EffectiveMySQL.com - Its all about Performance and Scalability Sunday, October 16, 2011