Security features of MariaDb

1. ‫امنیتی‬ ‫امکانات‬
MariaDB
‫شریف‬ ‫صنعتی‬ ‫دانشگاه‬ ‫داده‬ ‫پایگاه‬ ‫امنیت‬ ‫درس‬ ‫کالسی‬ ‫ارائه‬
‫دهندگان‬ ‫ارائه‬
:
‫دارا‬ ‫بهزاد‬
–
‫رضایی‬ ‫اکبر‬ ‫علی‬
‫درس‬ ‫استاد‬
:
‫نوگورانی‬ ‫دری‬ ‫صادق‬
‫اول‬ ‫نیمسال‬
14۰1
-
14۰۰

2. ‫اندازی‬ ‫راه‬ ‫و‬ ‫نصب‬
MariaDB
• Sudo apt update
• Sudo apt install –y mariadb-server mariadb-client
• Sudo systemctl status mariadb

3. ‫به‬ ‫اتصال‬
MariaDB
‫ها‬ ‫دسترسی‬ ‫تعریف‬ ‫و‬
• Sudo mysql –y root –p
•
‫داده‬ ‫پایگاه‬ ‫تعریف‬
:
• Create database ‘dbname’
• Show database
•
‫کاربر‬ ‫تعریف‬
:
• Create user ‘username’@localhost identified by ‘password’
• select user from MySQL.user

4. ‫به‬ ‫اتصال‬
MariaDB
‫ها‬ ‫دسترسی‬ ‫تعریف‬ ‫و‬
•
‫دسترسی‬ ‫تنظیم‬
( :
‫دسترسی‬ ‫بدون‬ ،‫ساخت‬ ‫از‬ ‫بعد‬ ‫کاربر‬
)
• Grant all privileges on ‘dbname’.* To ‘username’@localhost
• Flush privileges
• Show grants for ‘username’@localhost

5. ‫امنیتی‬ ‫ی‬ ‫اولیه‬ ‫تنظیمات‬
Sudo mysql-secure-installation
•
‫هویت‬ ‫احراز‬ ‫نوع‬ ‫انتخاب‬
•
‫داده‬ ‫پایگاه‬ ‫روی‬ ‫پسورد‬ ‫تنظیم‬
•
‫مجاز‬ ‫غیر‬ ‫کاربران‬ ‫حذف‬
•
‫ریموت‬ ‫دسترسی‬ ‫کردن‬ ‫مجاز‬ ‫غیر‬
•
‫تستی‬ ‫داده‬ ‫پایگاه‬ ‫حذف‬
•
‫جداول‬ ‫مجدد‬ ‫بارگزاری‬

6. ‫ی‬ ‫وسیله‬ ‫به‬ ‫امن‬ ‫اتصال‬
SSL
•
‫تنظیمات‬
SSL
•
‫روی‬ ‫کردن‬ ‫فعال‬
MariaDB
•
‫اتصال‬ ‫برای‬ ‫کاربر‬ ‫تعریف‬

7. COMPREHENSIVE USER
MANAGEMENT

8. USER MANAGEMENT
• user management is critical to securing databases
• mistakes and shorts can become prevalent, compromising security

9. TOPICS
• creating users
• User privileges
• Granting, revoking permissions
• role-based access control
• password validation
• user resource limits

10. Creating users
• has the following pattern:
CREATE [OR REPLACE] USER [IF NOT EXISTS] 'username'@'host_name'
IDENTIFIED BY 'password';
• For each account, CREATE USER creates a new row in mysql.user

11. Creating users - Host Name Component
• the hostname of the computer which the user connects from
• IP address of the computer that the user connects from
• the network that the user connects from
• to allow only local client connections, use 'localhost'
• If the host name is not provided, it is assumed to be '%‘
Examples:
CREATE USER 'boyd'@'%' IDENTIFIED BY 'bomber';
CREATE USER 'richard'@'powr.example.net' IDENTIFIED BY 'nuclear';
CREATE USER 'dallin'@'192.168.1.1' IDENTIFIED BY 'judge';

12. Creating users - Authentication Plugin - ed25519:
• The ed25519 authentication plugin uses Elliptic Curve Digital Signature
Algorithm (ECDSA)
• The ed25519 algorithm is the same one that is used by OpenSSH.
• INSTALL SONAME 'auth_ed25519';
• Example:
CREATE USER username@hostname IDENTIFIED VIA ed25519 USING
PASSWORD('secret');

13. Creating users - Authentication Plugin - PAM
• A pluggable authentication module (PAM) is a mechanism to integrate
multiple low-level authentication schemes into a high-level application
programming interface (API)
• INSTALL SONAME 'auth_pam';
• Example:
CREATE USER ‘username’@’hostname’ IDENTIFIED VIA pam;

14. Creating users - TLS Options:
• You can set certain TLS-related restrictions for specific user accounts. For
instance, you might use this with user accounts that require access to
sensitive data while sending it across networks that you do not control.
• can be enabled for a user account with the CREATE USER, ALTER USER
statements

15. Creating users - TLS Options
Option Description
REQUIRE NONE TLS is not required for this account, but can still be used.
REQUIRE SSL
The account must use TLS, but no valid X509 certificate is required. This
option cannot be combined with other TLS options.
REQUIRE X509
The account must use TLS and must have a valid X509 certificate. This
option implies REQUIRE SSL. This option cannot be combined with other TLS
options.
REQUIRE ISSUER 'issuer'
The account must use TLS and must have a valid X509 certificate. Also, the
Certificate Authority must be the one specified via the string issuer. This
option implies REQUIRE X509. This option can be combined with the SUBJECT,
and CIPHER options in any order.
REQUIRE SUBJECT 'subject'
The account must use TLS and must have a valid X509 certificate. Also, the
certificate's Subject must be the one specified via the string subject. This
option implies REQUIRE X509. This option can be combined with the ISSUER,
and CIPHER options in any order.
REQUIRE CIPHER 'cipher'
The account must use TLS, but no valid X509 certificate is required. Also,
the encryption used for the connection must use a specific cipher method
specified in the string cipher. This option implies REQUIRE SSL. This option can
be combined with the ISSUER, and SUBJECT options in any order.

16. Creating users - TLS Options
• The REQUIRE keyword must be used only once for all specified options,
and the AND keyword can be used to separate individual options, but it is
not required
• Example:
CREATE USER 'alice'@'%'
REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland'
AND ISSUER '/C=FI/ST=Somewhere/L=City/ O=Some Company/CN=Peter Parker/emailAddres
s=p.parker@marvel.com'
AND CIPHER 'SHA-DES-CBC3-EDH-RSA';

17. Creating users - Resource Limit Options
• MariaDB Platform can leverage user resource limits to stop and/or reduce
the damage caused by an attacker who’s employing compromised user
credentials.

18. Creating users - Resource Limit Options
Limit Type Decription
MAX_QUERIES_PER_HOUR
Number of statements that the account can issue per hour (including
updates)
MAX_UPDATES_PER_HOUR Number of updates (not queries) that the account can issue per hour
MAX_CONNECTIONS_PER_HOUR Number of connections that the account can start per hour
MAX_USER_CONNECTIONS
Number of simultaneous connections that can be accepted from the
same account; if it is 0, max_connections will be used instead;
if max_connections is 0, there is no limit for this account's simultaneous
connections.
MAX_STATEMENT_TIME Timeout, in seconds, for statements executed by the user.

19. Creating users - Resource Limit Options
• Example:
CREATE USER 'someone'@'localhost' WITH
MAX_USER_CONNECTIONS 10
MAX_QUERIES_PER_HOUR 200;

20. Creating users - Password Expiry
• Example:
ALTER USER 'monty'@'localhost' PASSWORD EXPIRE INTERVAL 120 DAY;
CREATE USER 'monty'@'localhost' PASSWORD EXPIRE INTERVAL 120 DAY;

21. DROP USER
Example:
DROP USER [IF EXISTS] user_name

22. GRANT
• The GRANT statement allows you to grant privileges or roles to accounts.
GRANT priv_type ON priv_level TO ‘username’@’hostname’

23. GRANT - Privileges

24. GRANT - Privilege Levels
 Global privileges priv_type are granted using *.* for priv_level. Global privileges include
privileges to administer the database and manage user accounts, as well as privileges for all
tables, functions, and procedures. Global privileges are stored in the mysql.user table.
 Database privileges priv_type are granted using db_name.* for priv_level, or using just * to
use default database. Database privileges include privileges to create tables and functions,
as well as privileges for all tables, functions, and procedures in the database. Database
privileges are stored in the mysql.db table.
 Table privileges priv_type are granted using db_name.tbl_name for priv_level, or using
just tbl_name to specify a table in the default database. The TABLE keyword is optional.
Table privileges include the ability to select and change data in the table. Certain table
privileges can be granted for individual columns.
 Column privileges priv_type are granted by specifying a table for priv_level and providing a
column list after the privilege type. They allow you to control exactly which columns in a table
users can select and change.
 Function privileges priv_type are granted using FUNCTION
db_name.routine_name for priv_level, or using just FUNCTION routine_name to specify a
function in the default database.
 Procedure privileges priv_type are granted using PROCEDURE
db_name.routine_name for priv_level, or using just PROCEDURE routine_name to specify a
procedure in the default database.

25. GRANT
Example:
• GRANT SELECT,INSERT,UPDATE,DELETE ON serv.* TO 'jeffrey'@'localhost';
• GRANT SELECT ON edu.staff TO 'david'@'localhost' WITH GRANT OPTION;
• GRANT ALL ON logan.* TO 'quentin'@'localhost'
WITHMAX_QUERIES_PER_HOUR 100;

26. REVOKE:
• Example:
REVOKE DELETE,GRANT OPTION ON cust.* FROM 'todd'@'%';
REVOKE ALL,GRANT OPTION FROM 'neil'@'%.example.com';
REVOKE priv_type ON priv_level FROM user

27. RBAC:
• created with the CREATE ROLE statement, and dropped with the DROP
ROLE statement.
• assigned to a user with an extension to the GRANT statement
• Once a user has connected, he can obtain all privileges associated with a
role by setting a role with the SET ROLE statement.
• The CURRENT_ROLE function returns the currently set role for the session,
if any.

28. Password Validation Plugin
• MariaDB comes with three password validation plugins — the
simple_password_check plugin, the cracklib_password_check plugin and
the password_reuse_check plugin.
• They are not enabled by default
• INSTALL SONAME 'simple_password_check';

29. Reference:
• https://en.wikipedia.org/wiki/MariaDB
• https://phoenixnap.com/kb/how-to-create-mariadb-user-grant-privileges
• https://www.alibabacloud.com/blog/how-to-secure-connections-to-
mariadb-with-ssl-encryption_595079
• https://mariadb.com/kb/en/create-user/
• https://mariadb.com/kb/en/authentication-plugin-
pam/#pam_google_authenticator
• https://mariadb.com/kb/en/grant/#account-names