MySQL Security on the Web

1
MySQL Security on the Web

• By
• Nicholas Frees

2
Why MySQL?

• Its free
• Open source
• Highly configurable
• High volume capabilities
• Cross platform compatibility

3
Securing your System

• Know your version
• Older than 4.1 has weak password protection
  (hash)
• Be aware of the common holes in whatever version
  you use
• Password strength
• Secure usernames
• Delete superfluous usernames
• Change admin name
• Permissions
• On global, database, table, and column
• Injection
• Magic Quotes (magic_quotes_gpc)
• Hex encoded strings
• Web Server
• Setup apache or other on same machine as MySQL

4
Staying Current

• Be sure to stay up to date on recently discovered
  security holes
• The National Vulnerability Database
  nvd.nist.gov
• Benchmarks
• Keep your version current
• MySQL Homepage www.mysql.com