MySQL Security: Difference between revisions

After extracting Uniform Server your first task should be to change the MySQL password.

 

To resolve this issue you can edit each applications configuration file and change the password accordingly. This method is '''very high risk''' especially if you intend to run a '''production server'''.

You probably are wondering what all the fuss is about the following attempts to explain the levels of security and why the root user is so dangerous.

A default installation of Uniform Server has a single user named '''root''' with password '''root'''. This user has full global privileges, significance of this privilege is '''server wide''' hence root user has full power to create and '''delete any database or table'''.

When installing an application you are required to enter a '''database name''' along with a '''user name''' and '''password'''. Using the root user for installation is convenient generally installation will proceed with no problems.

Although convenient unless steps are taken using root is an '''''extremely serious security issue'''''. Every time an application connects to the MySQL server it does so with all granted privileges. Should the application be compromised in anyway your entire MySQL sever is at risk.

Application programmers do their utmost to protect the application from malicious users. If the application becomes compromised generally only the application is killed however since the application connected with full privileges you can kiss your MySQL server good-bye.

To put the above into context for a test server the only person that can compromise your server is you hence not an issue. Putting your servers online any user can potentially compromise your servers hence you '''must take security seriously'''.

# Create a new user with limited privileges for that applications database only

# Change the applications configuration file to connect using the above user.

# Start UniTray: Navigate to folder '''UniServer''' double click on '''Start.exe'''

# Click Change (If challenged by your firewall allow access) '''F)'''

# Install application as per instructions.<br />Note: From the above MySQL server host is '''localhost''' user name '''root''' password f'''red123'''<br />Use the password you configured.<br /><br />

# For the remainder of this example I will assume you are using the MediaWiki plugin '''V55_MediaWiki_1_15_1.exe'''<br />Note: This is pre-configured and uses user name '''root''' and password '''root'''

# Enter required user name (example WikiUser) '''J)'''

# Select Host from drop down menu. Select '''localhost''' restricts access '''K)'''

# Enter password (from drop down menu select '''Use Text Field''') '''L)'''

# Confirm password '''M)'''<br />Note for this example I entered '''user123'''<br /><br />'''''Note'':''' The Add new User pages allows you to set global privileges for the user. This user is being created with absolute minimum privileges hence no global privileges are set. Ensure all preveleges are unchecked.<br /><br />

# Our new user is created and confirmation provided at top of the page. A new section is automatically added to current page named '''Database Specific Privileges''' scroll to this section.<br /><br />Note: You can assign more than one database to a user however this is a user with limited access hence a single database is assigned.<br /><br />

# From the drop down menu select '''wikidb''' '''O)'''<br /> This automatically openens a new page where you can assign priveleges to the user that are specific to the Wiki database '''wikidb'''<br /><br /><br /><br />

# When assigning privileges assign the absolute minimum possible to allow an application to run. If the application fails you can always go back and edit user privileges and enable more as required.<br /><br /> For MediaWiki the minimum is shown see section '''Data P)'''  

 

 

Generally for maximum security you would create a new user and password per application.   

Installing applications using root makes the whole process relatively easy since you have full privileges. After installation check the application runs then secure the MySQL server with a user with restricted privileges as explained above.

For a production server it is essential to secure your MySQL server. For a test server the choice is yours however if you put a test server online again you must secure it.