MySQL Server Hardening

Question

Following the hardening theme....

What are some best practices, recommendations, required reading for securing MySQL.

Answer 1

• Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services.
• Firewall - Limit access by IP address to only the servers / clients that require access.
• User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead limit to the host that requires access.
• Bind Address Appropriately - If you only require remote access to the server within the same network and the machine has both an external IP and an internal network address. Setup MySQL to only listen on the internal address.
• Enable Logging - Enable logging if the database doesn’t handle to many queries.
• mysql_secure_installation - Use the mysql_secure_installation utility which does a number of things including removing anonymous-user accounts, removes the test database etc.
• Root Account Accessible Local Only - Its best to limit the root account to be accessible only directly from the machine. The mysql_secure_installation does allow you to remove any remote access for root accounts easily. I usually then either ssh to the machine and use the mysql command prompt or MySQL Workbench has functionality to tunnel over SSH.

Additional Resources

• MySQL Security Best Practices (Hardening MySQL Tips)
• MySQL Best Practices: User Security
• Security in MySQL

Answer 2

I suppose the usual OS methods (including fail2ban if remote ssh admin is required), then block all external access to the MySQL port, or allow a whitelist to connect if absolutely necessary. Set a password for the mysqladmin user.

After that, the mysqladmin user should only be allowed to connect from localhost and should be the only user granted any privileges via the 'user' table - all other users denied access by default (i.e. in the user table) but given specific grants to individual databases.

Note that you should not expose MySQL directly on the internet. If you must have remote data access use a VPN (e.g. stunnel with client verification).