SlideShare a Scribd company logo
MariaDB/MySQL
Security Essentials
Colin Charles, Team MariaDB, MariaDB Corporation
colin@mariadb.com / byte@bytebot.net
http://bytebot.net/blog/ | @bytebot on Twitter
FLOSSUK 2016, London
17 March 2016
whoami
• Work on MariaDB at MariaDB Corporation (SkySQL
Ab)
• Merged with Monty Program Ab, makers of MariaDB
• Formerly MySQL AB (exit: Sun Microsystems)
• Past lives include Fedora Project (FESCO),
OpenOffice.org
• MySQL Community Contributor of the Year Award
winner 2014
Historically…
• No password for the ‘root’ user
• There is a default ‘test’ database
• Find a password from application config files (wp-
config.php, drupal’s settings.php, etc.)
• Are your datadir permissions secure (/var/lib/
mysql)?
• can you run strings mysql/user.MYD ?
Can you view privileges to
find a user with more access?
MariaDB [(none)]> SELECT host,user,password from mysql.user;
+--------------+-------------------+----------+
| host | user | password |
+--------------+-------------------+----------+
| localhost | root | |
| sirius | root | |
| 127.0.0.1 | root | |
| ::1 | root | |
| localhost | | |
| sirius | | |
+--------------+-------------------+----------+

Recommended for you

Lessons from database failures
Lessons from database failuresLessons from database failures
Lessons from database failures

Presented at the MySQL Chicago Meetup in August 2016. The focus of the talk is on backups and verification, replication and failover, as well as security and encryption.

mysqlpercona serverreplication
Best practices for MySQL/MariaDB Server/Percona Server High Availability
Best practices for MySQL/MariaDB Server/Percona Server High AvailabilityBest practices for MySQL/MariaDB Server/Percona Server High Availability
Best practices for MySQL/MariaDB Server/Percona Server High Availability

Best practices for MySQL/MariaDB Server/Percona Server High Availability - presented at Percona Live Amsterdam 2016. The focus is on picking the right High Availability solution, discussing replication, handling failure (yes, you can achieve a quick automatic failover), proxies (there are plenty), HA in the cloud/geographical redundancy, sharding solutions, how newer versions of MySQL help you, and what to watch for next.

high availabilityfailoverplams16
The Complete MariaDB Server tutorial
The Complete MariaDB Server tutorialThe Complete MariaDB Server tutorial
The Complete MariaDB Server tutorial

Presented at Percona Live Amsterdam 2016, this is an in-depth look at MariaDB Server right up to MariaDB Server 10.1. Learn the differences. See what's already in MySQL. And so on.

mysqlmariadb serverplams16
More things to think about
• Does replication connection have global
permissions?
• If you can start/stop mysqld process, you can
reset passwords
• Can you edit my.cnf? You can run a SQL file
when mysqld starts with init-file
sql_mode
• 5.6 default = NO_ENGINE_SUBSTITUTION
• SQL_MODE = STRICT_ALL_TABLES,
NO_ENGINE_SUBSTITUTION
• Keeps on improving, like deprecating
NO_ZERO_DATE, NO_ZERO_IN_DATE (5.6.17)
and making it part of strict mode
mysql_secure_installation
• Pretty basic to run, but many don’t
• Remove anonymous users
• Remove test database
• Remove non-localhost root users
• Set a root password
Creating users
• The lazy way
• CREATE USER ‘foo’@‘%’;
• GRANT ALL ON *.* TO ‘foo’@‘%’;
• The above gives you access to all tables in all
databases + access from any external location
• ALL gives you a lot of privileges, including
SHUTDOWN, SUPER, CHANGE MASTER, KILL,
USAGE, etc.

Recommended for you

Cool MariaDB Plugins
Cool MariaDB Plugins Cool MariaDB Plugins
Cool MariaDB Plugins

This document discusses MariaDB plugins and provides examples of several useful plugins, including authentication plugins, password validation plugins, SQL error logging, audit logging, query analysis, and more. It encourages contributing plugins to help extend MariaDB's functionality.

mariadbmysqlplugins
My first moments with MongoDB
My first moments with MongoDBMy first moments with MongoDB
My first moments with MongoDB

An introduction to MongoDB from an experienced MySQL user and developer. There are differences and we go thru the What/Why/Who/Where of MongoDB, the "similarities" to the MySQL world like storage engines, how replication is a little more interesting with built-in sharding and automatic failover, backups, monitoring, DBaaS, going to production and finding out more resources.

nosqlmongodbdatabase
MySQL features missing in MariaDB Server
MySQL features missing in MariaDB ServerMySQL features missing in MariaDB Server
MySQL features missing in MariaDB Server

MySQL features missing in MariaDB Server. Here's an overview from the New York developer's Unconference in February 2018. This is primarily aimed at the developers, to decide what goes into MariaDB 10.4, as opposed to users. High level comparisons are made between MySQL 5.6/5.7 with of course MySQL 8.0 as well. Here's to ensuring MariaDB Server 10/310.4 has more "Drop-in" compatibility.

mysqlmariadbmariadb server
SUPER privileges
• Can bypass a read_only
server
• Can bypass init_connect
• Can disable binary
logging
• Can dynamically change
configuration
• Reached
max_connections? Can
still make one connection
• https://dev.mysql.com/
doc/refman/5.6/en/
privileges-
provided.html#priv_super
• SUPER Read Only:
prohibit client updates for
everyone
So… only give users what
they need
• CREATE USER ‘foo’@‘localhost’ IDENTIFIED by
‘password’;
• GRANT CREATE, SELECT, INSERT, UPDATE,
DELETE on db.* to ‘foo’@‘localhost’;
And when it comes to
applications…
• Viewer? (read only access only)
• SELECT
• User? (read/write access)
• SELECT, INSERT, UPDATE, DELETE
• DBA? (provide access to the database)
• CREATE, DROP, etc.
Installation
• Using your Linux distribution… mostly gets you MariaDB when you
ask for mysql-server
• Except on Debian/Ubuntu
• However, when you get mariadb-server, you get an
authentication plugin — auth_socket for “automatic logins”
• You are asked by debhelper to enter a password
• You can use the APT/YUM repositories from Oracle MySQL,
Percona or MariaDB
• Don’t disable SELinux: system_u:system_r:mysqld_t:s0

Recommended for you

MariaDB Server Compatibility with MySQL
MariaDB Server Compatibility with MySQLMariaDB Server Compatibility with MySQL
MariaDB Server Compatibility with MySQL

At the MariaDB Server Developer's meeting in Amsterdam, Oct 8 2016. This was the deck to talk about what MariaDB Server 10.1/10.2 might be missing from MySQL versions up to 5.7. The focus is on compatibility of MariaDB Server with MySQL.

mysqlmariadb servermariadb
MariaDB 10: The Complete Tutorial
MariaDB 10: The Complete TutorialMariaDB 10: The Complete Tutorial
MariaDB 10: The Complete Tutorial

MariaDB 10: The Complete Tutorial for all the features within MariaDB 10. Presented at Percona Live MySQL Conference & Expo 2014 in Santa Clara

plmce2014mariadbmysql
Lessons from database failures
Lessons from database failures Lessons from database failures
Lessons from database failures

Failure happens, and we can learn from it. We need to think about backups, but also verification of them. We should definitely make use of replication and think about automatic failover. And security is key, but don't forget that encryption is now available in MySQL, Percona Server and MariaDB Server.

mysqlplams16database
Enable log-warnings
• Enable —log_warnings=2
• Can keep track of access denied messages
• Worth noting there are differences here in MySQL &
MariaDB
• https://dev.mysql.com/doc/refman/5.6/en/server-
options.html#option_mysqld_log-warnings
• https://mariadb.com/kb/en/mariadb/server-system-
variables/#log_warnings
MySQL 5.6 improvements
• Password expiry
• ALTER USER 'foo'@'localhost' PASSWORD
EXPIRE;
• https://dev.mysql.com/doc/refman/5.6/en/
password-expiration-sandbox-mode.html
• Password validation plugin
• VALIDATE_PASSWORD_STRENGTH()
MySQL 5.6 II
• mysql_config_editor - store authentication
credentials in an encrypted login path file
named .mylogin.cnf
• http://dev.mysql.com/doc/refman/5.6/en/mysql-
config-editor.html
• Random ‘root’ password on install
• mysql_install_db —random-passwords stored in
$HOME/.mysql_secret
MySQL 5.7
• Improved password expiry — automatic password
expiration available, so set
default_password_lifetime in my.cnf
• You can also require password to be changed every n-
days
• ALTER USER ‘foo'@'localhost' PASSWORD EXPIRE
INTERVAL n DAY;
• There is also account locking/unlocking now
• ACCOUNT LOCK/ACCOUNT UNLOCK

Recommended for you

The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScaleThe Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale

This document discusses MySQL proxy technologies including MySQL Router, ProxySQL, and MariaDB MaxScale. It provides an overview of each technology, including when they were released, key features, and comparisons between them. ProxySQL is highlighted as a popular option currently with integration with Percona tools, while MySQL Router may become more widely used due to its support for MySQL InnoDB Cluster. MariaDB MaxScale is noted for its binlog routing capabilities. Overall the document aims to help people understand and choose between the different MySQL proxy options.

fosdemfosdem2017proxy
MariaDB 10 Tutorial - 13.11.11 - Percona Live London
MariaDB 10 Tutorial - 13.11.11 - Percona Live LondonMariaDB 10 Tutorial - 13.11.11 - Percona Live London
MariaDB 10 Tutorial - 13.11.11 - Percona Live London

This document provides an overview and summary of MariaDB 10 features presented by Ivan Zoratti. It discusses new features in MariaDB 10 like storage engines, administration improvements, and replication capabilities. The document also summarizes optimization enhancements in MariaDB 10 like the new optimizer, improved indexing techniques, and subquery optimizations. Various agenda topics are outlined for the MariaDB 10 tutorial.

mysqlmariadb 10mariadb
A beginners guide to MariaDB
A beginners guide to MariaDBA beginners guide to MariaDB
A beginners guide to MariaDB

MariaDB started life as a database to host the Maria storage engine in 2009. Not long after its inception, the MySQL community went through yet another change in ownership, and it was deemed that MariaDB will be a complete database branch developed to extend MySQL, but with constant merging of upstream changes. The goal of the MariaDB project is to ensure that everyone is part of the community, including employees of the major steering companies. MariaDB also features enhanced features, some of which are common with the Percona Performance Server. Most importantly, MariaDB is a drop-in replacement and is completely backward compatible with MySQL. In 2010, MariaDB released 5.1 in February, and 5.2 in November – two major releases in a span of one calendar year is a feat that was achieved! DBAs and developers alike will gain an introduction to MariaDB, what is different with MySQL, how to make use of the feature enhancements, and more.

mariadbmysql
SSL
• You’re using the cloud and you’re using
replication… you don’t want this in cleartext
• Setup SSL (note: yaSSL vs OpenSSL can cause
issues)
• https://dev.mysql.com/doc/refman/5.6/en/ssl-
connections.html
• Worth noting 5.7 has a new tool:
mysql_ssl_rsa_setup
Initialise data directory using
mysqld now
• mysql_install_db is deprecated in 5.7
• mysqld itself handles instance initialisation
• mysqld —initialize
• mysqld —initialize-insecure
MariaDB passwords
• Password validation plugin (finally) exists now
• https://mariadb.com/kb/en/mariadb/development/mariadb-
internals-documentation/password-validation/
• simple_password_check password validation plugin
• can enforce a minimum password length and guarantee that a
password contains at least a specified number of uppercase
and lowercase letters, digits, and punctuation characters.
• cracklib_password_check password validation plugin
• Allows passwords that are strong enough to pass CrackLib test.
This is the same test that pam_cracklib.so does
authentication plugins

Recommended for you

The Complete MariaDB Server Tutorial - Percona Live 2015
The Complete MariaDB Server Tutorial - Percona Live 2015The Complete MariaDB Server Tutorial - Percona Live 2015
The Complete MariaDB Server Tutorial - Percona Live 2015

The document provides an overview of the Complete MariaDB Server Tutorial presentation. It introduces MariaDB and discusses what it is, its goals of being compatible with MySQL and having stable releases. It also covers MariaDB architecture, installation, utilities, and storage engines.

mariadbmysql
Differences between MariaDB 10.3 & MySQL 8.0
Differences between MariaDB 10.3 & MySQL 8.0Differences between MariaDB 10.3 & MySQL 8.0
Differences between MariaDB 10.3 & MySQL 8.0

MySQL and MariaDB are becoming more divergent. Learn what is different from a high level. It is also a good idea to ensure that you use the correct database for the correct job.

mysqlmariadbmariadb server
Why MariaDB?
Why MariaDB?Why MariaDB?
Why MariaDB?

The myriad reasons why you want to use MariaDB over stock MySQL. Current up to MariaDB 5.3, and presented at Percona Live London 2011.

percona livemariadbpercona live london
What you do today
• MySQL stores accounts in the user table of the
my mysql database
• CREATE USER ‘foo’@‘localhost’
IDENTIFIED BY ‘password’;
select plugin_name, plugin_status from
information_schema.plugins where
plugin_type='authentication';
+-----------------------+---------------+
| plugin_name | plugin_status |
+-----------------------+---------------+
| mysql_native_password | ACTIVE |
| mysql_old_password | ACTIVE |
+-----------------------+---------------+
2 rows in set (0.00 sec)
Subtle difference w/MariaDB
& MySQL usernames
• Usernames in MariaDB > 5.5.31? 80 character limit (which you
have to reload manually)
create user
'long12345678901234567890'@'localhost'
identified by 'pass';
Query OK, 0 rows affected (0.01 sec)
vs
ERROR 1470 (HY000): String
'long12345678901234567890' is too long for user
name (should be no longer than 16)
Installing plugins
• MariaDB: INSTALL SONAME ‘auth_socket’
• MySQL: INSTALL PLUGIN auth_socket
SONAME ‘auth_socket.so’

Recommended for you

The MySQL ecosystem - understanding it, not running away from it!
The MySQL ecosystem - understanding it, not running away from it! The MySQL ecosystem - understanding it, not running away from it!
The MySQL ecosystem - understanding it, not running away from it!

You're a busy DBA thinking about having to maintain a mix of this. Or you're a CIO planning to choose one branch over another. How do you go about picking? Supporting multiple databases? Find out more in this talk. Also covered is a deep-dive into what feature differences exist between MySQL/Percona Server/MariaDB Server. Within 20 minutes, you'll leave informed and knowledgable on what to pick. A base blog post to get started: https://www.percona.com/blog/2017/11/02/mysql-vs-mariadb-reality-check/

mysqlmariadbmariadb server
MariaDB: in-depth (hands on training in Seoul)
MariaDB: in-depth (hands on training in Seoul)MariaDB: in-depth (hands on training in Seoul)
MariaDB: in-depth (hands on training in Seoul)

MariaDB is a community-developed fork of MySQL that aims to be a drop-in replacement. It focuses on being compatible, stable with no regressions, and feature-enhanced compared to MySQL. The presentation covered MariaDB's architecture including connections, query caching, storage engines, and tools for administration and development like mysql, mysqldump, and EXPLAIN.

mysqlmariadb
Forking Successfully - or is a branch better?
Forking Successfully - or is a branch better?Forking Successfully - or is a branch better?
Forking Successfully - or is a branch better?

Forking Successfully or do you think a branch will work better? Learn from history, see what's current, etc. Presented at OSCON London 2016. This is forking beyond the github generation. And if you're going to do it, some tips on how you could be successful.

mariadbgnu emacsxemacs
auth_socket
• Authenticates against the Unix socket file
• Uses so_peercred socket option to obtain
information about user running client
• CREATE USER ‘foo’@‘localhost’
IDENTIFIED with auth_socket;
• Refuses connection of any other user but foo
from connecting
sha256_password
• Default in 5.6, needs SSL-built MySQL (if using it, best to set it
in my.cnf)
• default-authentication-plugin=sha256_password
• Default SSL is yaSSL, but with OpenSSL you get RSA
encryption
• client can transmit passwords to RSA server during
connection
• There exists key paths for private/public keys
• Passwords never exposed as cleartext when connecting
PAM Authentication
• MySQL PAM
• Percona PAM (auth_pam & auth_pam_compat)
• MariaDB PAM (pam)
Let’s get somethings out of
the way
• PAM = Pluggable Authentication Module
• Use pam_ldap to to authenticate credentials
against LDAP server — configure /etc/
pam_ldap.conf (you also obviously need /etc/
ldap.conf)
��� Simplest way is of course /etc/shadow auth

Recommended for you

MariaDB and Cassandra Interoperability
MariaDB and Cassandra InteroperabilityMariaDB and Cassandra Interoperability
MariaDB and Cassandra Interoperability

Presented at DataStax Cassandra Conference 2013 in San Francisco. Learn about using MariaDB with the Cassandra Storage Engine.

datastaxcassandrasedynamic columns
A Simple Multi-player Video Game Framework for Experimenting and Teaching C...
A Simple Multi-player Video Game  Framework for Experimenting  and Teaching C...A Simple Multi-player Video Game  Framework for Experimenting  and Teaching C...
A Simple Multi-player Video Game Framework for Experimenting and Teaching C...

Peter Jamieson, Miami University Lindsay Grace, American University Naoki Mizuno; Chris Bell; Darrell Davis, Miami University

mindtrek
The MySQL Server ecosystem in 2016
The MySQL Server ecosystem in 2016The MySQL Server ecosystem in 2016
The MySQL Server ecosystem in 2016

The document summarizes the history and current state of the MySQL database server ecosystem. It discusses the origins and development of MySQL, MariaDB, Percona Server, and other related projects. It also describes some of the key features and innovations in recent versions of these database servers. The ecosystem is very active with contributions from many organizations and the future remains promising with ongoing work.

Percona Server
INSTALL PLUGIN auth_pam SONAME ‘auth_pam.so';
CREATE USER byte IDENTIFIED WITH auth_pam;
In /etc/pam.d/mysqld:
auth required pam_warn.so
auth required pam_unix.so audit
account required pam_unix.so audit
MariaDB
INSTALL SONAME ‘auth_pam’;
CREATE USER byte IDENTIFIED via pam USING
‘mariadb’;
Edit /etc/pam.d/mariadb:
auth required
pam_unix.so
account required
pam_unix.so
For MySQL compatibility
• Just use —pam-use-cleartext-plugin for
MySQL to use mysql_cleartext_password
instead of dialog plugin
Possible errors
• Connectors don’t support it:
• Client does not support authentication
protocol requested by server; consider
upgrading MySQL client.
• You may have to re-compile connector using
libmysqlclient to have said support

Recommended for you

Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...

This document discusses the forking of open source software, using MySQL and MariaDB as a case study. It describes how MariaDB was forked from MySQL in 2009 after Oracle acquired Sun Microsystems and MySQL AB. This was done to ensure the continued open development of MySQL. Since then, MariaDB has grown into a successful open source database with a large community and adoption by organizations like Wikipedia. The document outlines the open development practices of MariaDB and how forking can both influence a project and ensure its long term success and viability.

mindtrek
Undelete (and more) rows from the binary log
Undelete (and more) rows from the binary logUndelete (and more) rows from the binary log
Undelete (and more) rows from the binary log

The document describes how to undelete rows from MySQL binary logs without doing a full point-in-time recovery. It shows deleting a row from a table, finding the delete event in the binary log, decoding the event, rebuilding it as a write event, and replaying it to undo the delete. This allows quickly undeleting rows by manipulating the binary log directly rather than doing a slow full restore.

point-in-timeundeleterecovery
Lessons from {distributed,remote,virtual} communities and companies
Lessons from {distributed,remote,virtual} communities and companiesLessons from {distributed,remote,virtual} communities and companies
Lessons from {distributed,remote,virtual} communities and companies

A last minute talk for the people at DevOps Amsterdam, happening around the same time as O'Reilly Velocity Amsterdam 2016. Here are lessons one can learn from distributed/remote/virtual communities and companies from someone that has spent a long time being remote and distributed.

distributedvirtualcommunity
Kerberos
• Every participant in authenticated communication is
known as a ‘principal’ (w/unique name)
• Principals belong to administrative groups called
realms. Kerberos Distribution Centre maintains a
database of principal in realm + associated secret keys
• Client requests a ticket from KDC for access to a
specific asset. KDC uses the client’s secret and the
server’s secret to construct the ticket which allows the
client and server to mutually authenticate each other,
while keeping the secrets hidden.
MariaDB Kerberos plugin
• User principals: <username>@<KERBEROS
REALM>
• CREATE USER 'byte' IDENTIFIED VIA
kerberos AS ‘byte/mariadb@lp';
• so that is <username>/
<instance>@<KERBEROS REALM>
• Store Service Principal Name (SPN) is an option in
a config file
Works where?
• GSSAPI-based Kerberos widely used &
supported on Linux
• Windows supports SSPI authentication and the
plugin supports it
• Comes with MariaDB Server 10.1
5.7 mysql_no_login
• mysql_no_login - prevents all client connections
to an account that uses it
• https://dev.mysql.com/doc/refman/5.7/en/mysql-
no-login-plugin.html

Recommended for you

Hoppala at O'Reilly Where 2.0 Conference
Hoppala at O'Reilly Where 2.0 ConferenceHoppala at O'Reilly Where 2.0 Conference
Hoppala at O'Reilly Where 2.0 Conference

The document discusses geobased augmented reality content management in the cloud. It provides examples of augmentations created by HOPPALA including Hoppala Goes Easter 3D, Woombamania 3D, and a virtual public art project along the Berlin Wall. It also outlines the native development and browser architecture used to display augmentations, and provides examples of augmentation metadata formats.

layargardeyaaugmented reality
The MySQL Server Ecosystem in 2016
The MySQL Server Ecosystem in 2016The MySQL Server Ecosystem in 2016
The MySQL Server Ecosystem in 2016

This was a short 25 minute talk, but we go into a bit of a history of MySQL, how the branches and forks appeared, what's sticking around today (branch? Percona Server. Fork? MariaDB Server). What should you use? Think about what you need today and what the roadmap holds.

percona livemariadb serverpercona server
Simple tips to improve Server Security
Simple tips to improve Server SecuritySimple tips to improve Server Security
Simple tips to improve Server Security

Simple tips to improve Server Security In these times, it’s very essential to secure your servers from the outside as well as from customers using the server. This session will show some basic methods on how to protect your server(s). Pulkit Gupta CEO & Chief Architect Softaculous

audit plugins
SQL Error Logging Plugin
• Log errors sent to clients in a log file that can be
analysed later. Log file can be rotated
(recommended)
• a MYSQL_AUDIT_PLUGIN
install plugin SQL_ERROR_LOG soname
'sql_errlog.so';
Audit Plugin
• Log server activity - who connects to the server,
what queries run, what tables touched - rotating
log file or syslogd
• MariaDB has extended the audit API, so user
filtering is possible
• a MYSQL_AUDIT_PLUGIN
INSTALL PLUGIN server_audit SONAME
‘server_audit.so’;
Roles
• Bundles users together, with similar privileges -
follows the SQL standard
CREATE ROLE audit_bean_counters;
GRANT SELECT ON accounts.* to
audit_bean_counters;
GRANT audit_bean_counters to ceo;

Recommended for you

Kafka Security 101 and Real-World Tips
Kafka Security 101 and Real-World Tips Kafka Security 101 and Real-World Tips
Kafka Security 101 and Real-World Tips

(Stephane Maarek, DataCumulus) Kafka Summit SF 2018 Security in Kafka is a cornerstone of true enterprise production-ready deployment: It enables companies to control access to the cluster and limit risks in data corruption and unwanted operations. Understanding how to use security in Kafka and exploiting its capabilities can be complex, especially as the documentation that is available is aimed at people with substantial existing knowledge on the matter. This talk will be delivered in a “hero journey” fashion, tracing the experience of an engineer with basic understanding of Kafka who is tasked with securing a Kafka cluster. Along the way, I will illustrate the benefits and implications of various mechanisms and provide some real-world tips on how users can simplify security management. Attendees of this talk will learn about aspects of security in Kafka, including: -Encryption: What is SSL, what problems it solves and how Kafka leverages it. We’ll discuss encryption in flight vs. encryption at rest. -Authentication: Without authentication, anyone would be able to write to any topic in a Kafka cluster, do anything and remain anonymous. We’ll explore the available authentication mechanisms and their suitability for different types of deployment, including mutual SSL authentication, SASL/GSSAPI, SASL/SCRAM and SASL/PLAIN. -Authorization: How ACLs work in Kafka, ZooKeeper security (risks and mitigations) and how to manage ACLs at scale

apachekafkasummit
Paris FOD meetup - kafka security 101
Paris FOD meetup - kafka security 101Paris FOD meetup - kafka security 101
Paris FOD meetup - kafka security 101

This document discusses Kafka security and provides tips for implementing it. It covers the three main aspects of Kafka security: encryption, authentication, and authorization. For encryption, it explains how to set up SSL and discusses options for end-to-end encryption. Authentication details how to use SSL client authentication or SASL mechanisms like Kerberos or PLAIN. Authorization explains managing access control lists (ACLs) stored in Zookeeper to control access. The document concludes by emphasizing the challenges of securing Kafka clients and provides advice like creating standardized client wrappers and Docker images.

kafkasecurityhortonworks
MySQL Security in a Cloudy World
MySQL Security in a Cloudy WorldMySQL Security in a Cloudy World
MySQL Security in a Cloudy World

MySQL is the most popular database on the web but how do you keep your data safe as it is virtualized, contained, put into the cloud, replicated, and sharded out to servers where DBAs have minimal actual control.

mysqldatabasevirtual
Encryption
• Encryption: tablespace and table level encryption with support
for rolling keys using the AES algorithm
• table encryption — PAGE_ENCRYPTION=1
• tablespace encryption — encrypts everything including log
files
• New file_key_management_filename,
file_key_management_filekey,
file_key_management_encryption_algorithm
• Well documented — https://mariadb.com/kb/en/mariadb/data-at-
rest-encryption/
Encryption II
• The key file contains encryption keys identifiers
(32-bit numbers) and hex-encoded encryption
keys (128-256 bit keys), separated by a
semicolon.
• don’t forget to create keys!
• eg. openssl enc -aes-256-cbc -md
sha1 -k secret -in keys.txt -out
keys.enc
my.cnf config
[mysqld]
plugin-load-add=file_key_management.so
file-key-management
file-key-management-filename = /home/mdb/keys.enc
innodb-encrypt-tables
innodb-encrypt-log
innodb-encryption-threads=4
aria-encrypt-tables=1 # PAGE row format
encrypt-tmp-disk-tables=1 # this is for Aria
Encryption III
CREATE TABLE customer (
customer_id bigint not null primary key,
customer_name varchar(80),
customer_creditcard varchar(20))
ENGINE=InnoDB
page_encryption=1
page_encryption_key=1;

Recommended for you

Securing your web apps now
Securing your web apps nowSecuring your web apps now
Securing your web apps now

The importance of security in 2013, with more websites getting hacked daily and penetration testers being one of the most the requested IT jobs. Develops need to be sure how secure their applications against threads like SQL injection, cross site scripting, weak passwords, brute force or dictionary attacks.

information securityphpsecurity
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!

SQL Server has been running on Windows for years. Now Microsoft is making it available on Linux in order to provide a consistent database platform across Window and Linux servers, as well as on-premises and in the cloud. In this presentation, Janis Griffin, database performance evangelist at SolarWinds, discusses the advantages of using SQL Server on Linux, comparing architecture, cost and performance.

linuxdpadatabase
Staying Sane with Drupal NEPHP
Staying Sane with Drupal NEPHPStaying Sane with Drupal NEPHP
Staying Sane with Drupal NEPHP

This document provides tips and best practices for staying sane as a Drupal developer. It discusses that 80% of building Drupal sites is configuration, while the remaining 20% requires customization. It emphasizes using Drupal APIs and hooks, playing well with contributed modules, and following coding standards and best practices like version control, automated testing and deployment, and documentation.

phpdrupalprogramming
Encryption IV
• Tablespace encryption (Google)
• again, you need to pick an encryption algorithm
• specify what to encrypt: innodb-encrypt-tables,
aria, aria-encrypt-tables, encrypt-tmp-
disk-tables, innodb-encrypt-log
• don’t forget key rotation:
• innodb-encryption-threads=4
• innodb-encryption-rotate-key-age=1800
Encryption V
• we also have tablespace scrubbing
• background process that regularly scans
through the tables and upgrades the
encryption keys
• scrubbing works for tablespaces and logs
• —encrypt-tmp-files
• —encrypt-binlog
Encryption VI
• /etc/my.cnf.d/enable_encryption.preset
• Consider using Eperi Gateway for Databases
• MariaDB Enterprise will have a plugin for Amazon Key
Management Server (KMS)
• mysqlbinlog has no way to read (i.e. decrypt) an
encrypted binlog
• This does not work with MariaDB Galera Cluster yet
(gcache is not encrypted yet), and also xtrabackup needs
additional work (i.e. if you encrypt the redo log)
Preventing SQL Injections
• MySQL Enterprise Firewall ($$$)
• http://mysqlserverteam.com/new-mysql-enterprise-
firewall-prevent-sql-injection-attacks/
• MaxScale Database Firewall filter (write your own
regex)
• https://mariadb.com/kb/en/mariadb-enterprise/
maxscale/maxscale-database-firewall-filter/
• https://mariadb.com/blog/maxscale-firewall-filter

Recommended for you

Mysql user-camp-march-11th-2016
Mysql user-camp-march-11th-2016Mysql user-camp-march-11th-2016
Mysql user-camp-march-11th-2016

An Overview of MySQL 5.7 Security Features. Presented in MySQL User Camp's Bangalore Edition on March 11, 2016.

MySQL Security
MySQL SecurityMySQL Security
MySQL Security

This document discusses database security and best practices for securing MySQL databases. It covers common database vulnerabilities like poor configurations, weak authentication, lack of encryption, and improper credential management. It also discusses database attacks like SQL injection and brute force attacks. The document provides recommendations for database administrators to properly configure access controls, encryption, auditing, backups and monitoring to harden MySQL databases.

mysql security pci compliance
The Spy Who Loathed Me - An Intro to SQL Server Security
The Spy Who Loathed Me - An Intro to SQL Server SecurityThe Spy Who Loathed Me - An Intro to SQL Server Security
The Spy Who Loathed Me - An Intro to SQL Server Security

You have lots of data you have painstakingly collected over the years. How do you ensure that data is protected from hackers, spies and other ne’er-do-wells? Understanding the vast array of security features available in SQL Server is the first step in helping you determine what actions you need to take now to protect your data. Fonts used: SkyFall Done Calibri

spysql serverwaterox
Resources
• oak-security-audit
• https://openarkkit.googlecode.com/svn/trunk/
openarkkit/doc/html/oak-security-audit.html
• Securich
• http://www.securich.com/
• Encrypting MySQL Data at Google - Jeremy Cole & Jonas
Oreland
• http://bit.ly/google_innodb_encryption
Thank you!
Colin Charles
colin@mariadb.org / byte@bytebot.net
http://bytebot.net/blog | @bytebot on twitter
slides: slideshare.net/bytebot

More Related Content

What's hot

Better encryption & security with MariaDB 10.1 & MySQL 5.7
Better encryption & security with MariaDB 10.1 & MySQL 5.7Better encryption & security with MariaDB 10.1 & MySQL 5.7
Better encryption & security with MariaDB 10.1 & MySQL 5.7
Colin Charles
 
Distributions from the view a package
Distributions from the view a packageDistributions from the view a package
Distributions from the view a package
Colin Charles
 
Databases in the hosted cloud
Databases in the hosted cloudDatabases in the hosted cloud
Databases in the hosted cloud
Colin Charles
 
Lessons from database failures
Lessons from database failuresLessons from database failures
Lessons from database failures
Colin Charles
 
Best practices for MySQL/MariaDB Server/Percona Server High Availability
Best practices for MySQL/MariaDB Server/Percona Server High AvailabilityBest practices for MySQL/MariaDB Server/Percona Server High Availability
Best practices for MySQL/MariaDB Server/Percona Server High Availability
Colin Charles
 
The Complete MariaDB Server tutorial
The Complete MariaDB Server tutorialThe Complete MariaDB Server tutorial
The Complete MariaDB Server tutorial
Colin Charles
 
Cool MariaDB Plugins
Cool MariaDB Plugins Cool MariaDB Plugins
Cool MariaDB Plugins
Colin Charles
 
My first moments with MongoDB
My first moments with MongoDBMy first moments with MongoDB
My first moments with MongoDB
Colin Charles
 
MySQL features missing in MariaDB Server
MySQL features missing in MariaDB ServerMySQL features missing in MariaDB Server
MySQL features missing in MariaDB Server
Colin Charles
 
MariaDB Server Compatibility with MySQL
MariaDB Server Compatibility with MySQLMariaDB Server Compatibility with MySQL
MariaDB Server Compatibility with MySQL
Colin Charles
 
MariaDB 10: The Complete Tutorial
MariaDB 10: The Complete TutorialMariaDB 10: The Complete Tutorial
MariaDB 10: The Complete Tutorial
Colin Charles
 
Lessons from database failures
Lessons from database failures Lessons from database failures
Lessons from database failures
Colin Charles
 
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScaleThe Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
Colin Charles
 
MariaDB 10 Tutorial - 13.11.11 - Percona Live London
MariaDB 10 Tutorial - 13.11.11 - Percona Live LondonMariaDB 10 Tutorial - 13.11.11 - Percona Live London
MariaDB 10 Tutorial - 13.11.11 - Percona Live London
Ivan Zoratti
 
A beginners guide to MariaDB
A beginners guide to MariaDBA beginners guide to MariaDB
A beginners guide to MariaDB
Colin Charles
 
The Complete MariaDB Server Tutorial - Percona Live 2015
The Complete MariaDB Server Tutorial - Percona Live 2015The Complete MariaDB Server Tutorial - Percona Live 2015
The Complete MariaDB Server Tutorial - Percona Live 2015
Colin Charles
 
Differences between MariaDB 10.3 & MySQL 8.0
Differences between MariaDB 10.3 & MySQL 8.0Differences between MariaDB 10.3 & MySQL 8.0
Differences between MariaDB 10.3 & MySQL 8.0
Colin Charles
 
Why MariaDB?
Why MariaDB?Why MariaDB?
Why MariaDB?
Colin Charles
 
The MySQL ecosystem - understanding it, not running away from it!
The MySQL ecosystem - understanding it, not running away from it! The MySQL ecosystem - understanding it, not running away from it!
The MySQL ecosystem - understanding it, not running away from it!
Colin Charles
 
MariaDB: in-depth (hands on training in Seoul)
MariaDB: in-depth (hands on training in Seoul)MariaDB: in-depth (hands on training in Seoul)
MariaDB: in-depth (hands on training in Seoul)
Colin Charles
 

What's hot (20)

Better encryption & security with MariaDB 10.1 & MySQL 5.7
Better encryption & security with MariaDB 10.1 & MySQL 5.7Better encryption & security with MariaDB 10.1 & MySQL 5.7
Better encryption & security with MariaDB 10.1 & MySQL 5.7
 
Distributions from the view a package
Distributions from the view a packageDistributions from the view a package
Distributions from the view a package
 
Databases in the hosted cloud
Databases in the hosted cloudDatabases in the hosted cloud
Databases in the hosted cloud
 
Lessons from database failures
Lessons from database failuresLessons from database failures
Lessons from database failures
 
Best practices for MySQL/MariaDB Server/Percona Server High Availability
Best practices for MySQL/MariaDB Server/Percona Server High AvailabilityBest practices for MySQL/MariaDB Server/Percona Server High Availability
Best practices for MySQL/MariaDB Server/Percona Server High Availability
 
The Complete MariaDB Server tutorial
The Complete MariaDB Server tutorialThe Complete MariaDB Server tutorial
The Complete MariaDB Server tutorial
 
Cool MariaDB Plugins
Cool MariaDB Plugins Cool MariaDB Plugins
Cool MariaDB Plugins
 
My first moments with MongoDB
My first moments with MongoDBMy first moments with MongoDB
My first moments with MongoDB
 
MySQL features missing in MariaDB Server
MySQL features missing in MariaDB ServerMySQL features missing in MariaDB Server
MySQL features missing in MariaDB Server
 
MariaDB Server Compatibility with MySQL
MariaDB Server Compatibility with MySQLMariaDB Server Compatibility with MySQL
MariaDB Server Compatibility with MySQL
 
MariaDB 10: The Complete Tutorial
MariaDB 10: The Complete TutorialMariaDB 10: The Complete Tutorial
MariaDB 10: The Complete Tutorial
 
Lessons from database failures
Lessons from database failures Lessons from database failures
Lessons from database failures
 
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScaleThe Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
The Proxy Wars - MySQL Router, ProxySQL, MariaDB MaxScale
 
MariaDB 10 Tutorial - 13.11.11 - Percona Live London
MariaDB 10 Tutorial - 13.11.11 - Percona Live LondonMariaDB 10 Tutorial - 13.11.11 - Percona Live London
MariaDB 10 Tutorial - 13.11.11 - Percona Live London
 
A beginners guide to MariaDB
A beginners guide to MariaDBA beginners guide to MariaDB
A beginners guide to MariaDB
 
The Complete MariaDB Server Tutorial - Percona Live 2015
The Complete MariaDB Server Tutorial - Percona Live 2015The Complete MariaDB Server Tutorial - Percona Live 2015
The Complete MariaDB Server Tutorial - Percona Live 2015
 
Differences between MariaDB 10.3 & MySQL 8.0
Differences between MariaDB 10.3 & MySQL 8.0Differences between MariaDB 10.3 & MySQL 8.0
Differences between MariaDB 10.3 & MySQL 8.0
 
Why MariaDB?
Why MariaDB?Why MariaDB?
Why MariaDB?
 
The MySQL ecosystem - understanding it, not running away from it!
The MySQL ecosystem - understanding it, not running away from it! The MySQL ecosystem - understanding it, not running away from it!
The MySQL ecosystem - understanding it, not running away from it!
 
MariaDB: in-depth (hands on training in Seoul)
MariaDB: in-depth (hands on training in Seoul)MariaDB: in-depth (hands on training in Seoul)
MariaDB: in-depth (hands on training in Seoul)
 

Viewers also liked

Forking Successfully - or is a branch better?
Forking Successfully - or is a branch better?Forking Successfully - or is a branch better?
Forking Successfully - or is a branch better?
Colin Charles
 
MariaDB and Cassandra Interoperability
MariaDB and Cassandra InteroperabilityMariaDB and Cassandra Interoperability
MariaDB and Cassandra Interoperability
Colin Charles
 
A Simple Multi-player Video Game Framework for Experimenting and Teaching C...
A Simple Multi-player Video Game  Framework for Experimenting  and Teaching C...A Simple Multi-player Video Game  Framework for Experimenting  and Teaching C...
A Simple Multi-player Video Game Framework for Experimenting and Teaching C...
Mindtrek
 
The MySQL Server ecosystem in 2016
The MySQL Server ecosystem in 2016The MySQL Server ecosystem in 2016
The MySQL Server ecosystem in 2016
sys army
 
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
Mindtrek
 
Undelete (and more) rows from the binary log
Undelete (and more) rows from the binary logUndelete (and more) rows from the binary log
Undelete (and more) rows from the binary log
Frederic Descamps
 
Lessons from {distributed,remote,virtual} communities and companies
Lessons from {distributed,remote,virtual} communities and companiesLessons from {distributed,remote,virtual} communities and companies
Lessons from {distributed,remote,virtual} communities and companies
Colin Charles
 
Hoppala at O'Reilly Where 2.0 Conference
Hoppala at O'Reilly Where 2.0 ConferenceHoppala at O'Reilly Where 2.0 Conference
Hoppala at O'Reilly Where 2.0 Conference
Marc René Gardeya
 
The MySQL Server Ecosystem in 2016
The MySQL Server Ecosystem in 2016The MySQL Server Ecosystem in 2016
The MySQL Server Ecosystem in 2016
Colin Charles
 

Viewers also liked (9)

Forking Successfully - or is a branch better?
Forking Successfully - or is a branch better?Forking Successfully - or is a branch better?
Forking Successfully - or is a branch better?
 
MariaDB and Cassandra Interoperability
MariaDB and Cassandra InteroperabilityMariaDB and Cassandra Interoperability
MariaDB and Cassandra Interoperability
 
A Simple Multi-player Video Game Framework for Experimenting and Teaching C...
A Simple Multi-player Video Game  Framework for Experimenting  and Teaching C...A Simple Multi-player Video Game  Framework for Experimenting  and Teaching C...
A Simple Multi-player Video Game Framework for Experimenting and Teaching C...
 
The MySQL Server ecosystem in 2016
The MySQL Server ecosystem in 2016The MySQL Server ecosystem in 2016
The MySQL Server ecosystem in 2016
 
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
Otto Kekäläinen - Forking in Open Source: Case Study of MySQL/MariaDB - Mindt...
 
Undelete (and more) rows from the binary log
Undelete (and more) rows from the binary logUndelete (and more) rows from the binary log
Undelete (and more) rows from the binary log
 
Lessons from {distributed,remote,virtual} communities and companies
Lessons from {distributed,remote,virtual} communities and companiesLessons from {distributed,remote,virtual} communities and companies
Lessons from {distributed,remote,virtual} communities and companies
 
Hoppala at O'Reilly Where 2.0 Conference
Hoppala at O'Reilly Where 2.0 ConferenceHoppala at O'Reilly Where 2.0 Conference
Hoppala at O'Reilly Where 2.0 Conference
 
The MySQL Server Ecosystem in 2016
The MySQL Server Ecosystem in 2016The MySQL Server Ecosystem in 2016
The MySQL Server Ecosystem in 2016
 

Similar to MariaDB Server & MySQL Security Essentials 2016

Simple tips to improve Server Security
Simple tips to improve Server SecuritySimple tips to improve Server Security
Simple tips to improve Server Security
ResellerClub
 
Kafka Security 101 and Real-World Tips
Kafka Security 101 and Real-World Tips Kafka Security 101 and Real-World Tips
Kafka Security 101 and Real-World Tips
confluent
 
Paris FOD meetup - kafka security 101
Paris FOD meetup - kafka security 101Paris FOD meetup - kafka security 101
Paris FOD meetup - kafka security 101
Abdelkrim Hadjidj
 
MySQL Security in a Cloudy World
MySQL Security in a Cloudy WorldMySQL Security in a Cloudy World
MySQL Security in a Cloudy World
Dave Stokes
 
Securing your web apps now
Securing your web apps nowSecuring your web apps now
Securing your web apps now
Stephan Steynfaardt
 
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
SolarWinds
 
Staying Sane with Drupal NEPHP
Staying Sane with Drupal NEPHPStaying Sane with Drupal NEPHP
Staying Sane with Drupal NEPHP
Oscar Merida
 
Mysql user-camp-march-11th-2016
Mysql user-camp-march-11th-2016Mysql user-camp-march-11th-2016
Mysql user-camp-march-11th-2016
Harin Vadodaria
 
MySQL Security
MySQL SecurityMySQL Security
MySQL Security
Ted Wennmark
 
The Spy Who Loathed Me - An Intro to SQL Server Security
The Spy Who Loathed Me - An Intro to SQL Server SecurityThe Spy Who Loathed Me - An Intro to SQL Server Security
The Spy Who Loathed Me - An Intro to SQL Server Security
Chris Bell
 
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
SolarWinds
 
MySQL for Oracle DBAs
MySQL for Oracle DBAsMySQL for Oracle DBAs
MySQL for Oracle DBAs
Ben Krug
 
Visualizing Kafka Security
Visualizing Kafka SecurityVisualizing Kafka Security
Visualizing Kafka Security
DataWorks Summit
 
Adm02. IBM Connections Adminblast
Adm02. IBM Connections AdminblastAdm02. IBM Connections Adminblast
Adm02. IBM Connections Adminblast
panagenda
 
Drupal security
Drupal securityDrupal security
Drupal security
Jozef Toth
 
Mysql 8 vs Mariadb 10.4 Highload++ 2019
Mysql 8 vs Mariadb 10.4 Highload++ 2019Mysql 8 vs Mariadb 10.4 Highload++ 2019
Mysql 8 vs Mariadb 10.4 Highload++ 2019
Alkin Tezuysal
 
OUGLS 2016: Guided Tour On The MySQL Source Code
OUGLS 2016: Guided Tour On The MySQL Source CodeOUGLS 2016: Guided Tour On The MySQL Source Code
OUGLS 2016: Guided Tour On The MySQL Source Code
Georgi Kodinov
 
MySQL 5.7 + Java
MySQL 5.7 + JavaMySQL 5.7 + Java
MySQL 5.7 + Java
Mark Swarbrick
 
MySQL highav Availability
MySQL highav AvailabilityMySQL highav Availability
MySQL highav Availability
Baruch Osoveskiy
 
Introduction to firebidSQL 3.x
Introduction to firebidSQL 3.xIntroduction to firebidSQL 3.x
Introduction to firebidSQL 3.x
Fabio Codebue
 

Similar to MariaDB Server & MySQL Security Essentials 2016 (20)

Simple tips to improve Server Security
Simple tips to improve Server SecuritySimple tips to improve Server Security
Simple tips to improve Server Security
 
Kafka Security 101 and Real-World Tips
Kafka Security 101 and Real-World Tips Kafka Security 101 and Real-World Tips
Kafka Security 101 and Real-World Tips
 
Paris FOD meetup - kafka security 101
Paris FOD meetup - kafka security 101Paris FOD meetup - kafka security 101
Paris FOD meetup - kafka security 101
 
MySQL Security in a Cloudy World
MySQL Security in a Cloudy WorldMySQL Security in a Cloudy World
MySQL Security in a Cloudy World
 
Securing your web apps now
Securing your web apps nowSecuring your web apps now
Securing your web apps now
 
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
 
Staying Sane with Drupal NEPHP
Staying Sane with Drupal NEPHPStaying Sane with Drupal NEPHP
Staying Sane with Drupal NEPHP
 
Mysql user-camp-march-11th-2016
Mysql user-camp-march-11th-2016Mysql user-camp-march-11th-2016
Mysql user-camp-march-11th-2016
 
MySQL Security
MySQL SecurityMySQL Security
MySQL Security
 
The Spy Who Loathed Me - An Intro to SQL Server Security
The Spy Who Loathed Me - An Intro to SQL Server SecurityThe Spy Who Loathed Me - An Intro to SQL Server Security
The Spy Who Loathed Me - An Intro to SQL Server Security
 
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
Hi! Ho! Hi! Ho! SQL Server on Linux We Go!
 
MySQL for Oracle DBAs
MySQL for Oracle DBAsMySQL for Oracle DBAs
MySQL for Oracle DBAs
 
Visualizing Kafka Security
Visualizing Kafka SecurityVisualizing Kafka Security
Visualizing Kafka Security
 
Adm02. IBM Connections Adminblast
Adm02. IBM Connections AdminblastAdm02. IBM Connections Adminblast
Adm02. IBM Connections Adminblast
 
Drupal security
Drupal securityDrupal security
Drupal security
 
Mysql 8 vs Mariadb 10.4 Highload++ 2019
Mysql 8 vs Mariadb 10.4 Highload++ 2019Mysql 8 vs Mariadb 10.4 Highload++ 2019
Mysql 8 vs Mariadb 10.4 Highload++ 2019
 
OUGLS 2016: Guided Tour On The MySQL Source Code
OUGLS 2016: Guided Tour On The MySQL Source CodeOUGLS 2016: Guided Tour On The MySQL Source Code
OUGLS 2016: Guided Tour On The MySQL Source Code
 
MySQL 5.7 + Java
MySQL 5.7 + JavaMySQL 5.7 + Java
MySQL 5.7 + Java
 
MySQL highav Availability
MySQL highav AvailabilityMySQL highav Availability
MySQL highav Availability
 
Introduction to firebidSQL 3.x
Introduction to firebidSQL 3.xIntroduction to firebidSQL 3.x
Introduction to firebidSQL 3.x
 

More from Colin Charles

What is MariaDB Server 10.3?
What is MariaDB Server 10.3?What is MariaDB Server 10.3?
What is MariaDB Server 10.3?
Colin Charles
 
Databases in the hosted cloud
Databases in the hosted cloud Databases in the hosted cloud
Databases in the hosted cloud
Colin Charles
 
Databases in the Hosted Cloud
Databases in the Hosted CloudDatabases in the Hosted Cloud
Databases in the Hosted Cloud
Colin Charles
 
Best practices for MySQL High Availability Tutorial
Best practices for MySQL High Availability TutorialBest practices for MySQL High Availability Tutorial
Best practices for MySQL High Availability Tutorial
Colin Charles
 
Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)
Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)
Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)
Colin Charles
 
Capacity planning for your data stores
Capacity planning for your data storesCapacity planning for your data stores
Capacity planning for your data stores
Colin Charles
 

More from Colin Charles (6)

What is MariaDB Server 10.3?
What is MariaDB Server 10.3?What is MariaDB Server 10.3?
What is MariaDB Server 10.3?
 
Databases in the hosted cloud
Databases in the hosted cloud Databases in the hosted cloud
Databases in the hosted cloud
 
Databases in the Hosted Cloud
Databases in the Hosted CloudDatabases in the Hosted Cloud
Databases in the Hosted Cloud
 
Best practices for MySQL High Availability Tutorial
Best practices for MySQL High Availability TutorialBest practices for MySQL High Availability Tutorial
Best practices for MySQL High Availability Tutorial
 
Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)
Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)
Percona ServerをMySQL 5.6と5.7用に作るエンジニアリング(そしてMongoDBのヒント)
 
Capacity planning for your data stores
Capacity planning for your data storesCapacity planning for your data stores
Capacity planning for your data stores
 

Recently uploaded

20240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 202420240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 2024
Matthew Sinclair
 
Calgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptxCalgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptx
ishalveerrandhawa1
 
Coordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar SlidesCoordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar Slides
Safe Software
 
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdfWhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
ArgaBisma
 
20240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 202420240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 2024
Matthew Sinclair
 
Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...
BookNet Canada
 
What's New in Copilot for Microsoft365 May 2024.pptx
What's New in Copilot for Microsoft365 May 2024.pptxWhat's New in Copilot for Microsoft365 May 2024.pptx
What's New in Copilot for Microsoft365 May 2024.pptx
Stephanie Beckett
 
BLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALL
BLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALLBLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALL
BLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALL
Liveplex
 
How Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdfHow Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdf
HackersList
 
Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024
BookNet Canada
 
Choose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presenceChoose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presence
rajancomputerfbd
 
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyyActive Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
RaminGhanbari2
 
How to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptxHow to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptx
Adam Dunkels
 
Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...
Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...
Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...
Erasmo Purificato
 
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptxRPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
SynapseIndia
 
Research Directions for Cross Reality Interfaces
Research Directions for Cross Reality InterfacesResearch Directions for Cross Reality Interfaces
Research Directions for Cross Reality Interfaces
Mark Billinghurst
 
Observability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetryObservability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetry
Eric D. Schabell
 
The Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU CampusesThe Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU Campuses
Larry Smarr
 
Password Rotation in 2024 is still Relevant
Password Rotation in 2024 is still RelevantPassword Rotation in 2024 is still Relevant
Password Rotation in 2024 is still Relevant
Bert Blevins
 
[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf
[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf
[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf
Kief Morris
 

Recently uploaded (20)

20240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 202420240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 2024
 
Calgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptxCalgary MuleSoft Meetup APM and IDP .pptx
Calgary MuleSoft Meetup APM and IDP .pptx
 
Coordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar SlidesCoordinate Systems in FME 101 - Webinar Slides
Coordinate Systems in FME 101 - Webinar Slides
 
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdfWhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
 
20240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 202420240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 2024
 
Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...
 
What's New in Copilot for Microsoft365 May 2024.pptx
What's New in Copilot for Microsoft365 May 2024.pptxWhat's New in Copilot for Microsoft365 May 2024.pptx
What's New in Copilot for Microsoft365 May 2024.pptx
 
BLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALL
BLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALLBLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALL
BLOCKCHAIN FOR DUMMIES: GUIDEBOOK FOR ALL
 
How Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdfHow Social Media Hackers Help You to See Your Wife's Message.pdf
How Social Media Hackers Help You to See Your Wife's Message.pdf
 
Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024
 
Choose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presenceChoose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presence
 
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyyActive Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
 
How to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptxHow to Build a Profitable IoT Product.pptx
How to Build a Profitable IoT Product.pptx
 
Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...
Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...
Paradigm Shifts in User Modeling: A Journey from Historical Foundations to Em...
 
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptxRPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
RPA In Healthcare Benefits, Use Case, Trend And Challenges 2024.pptx
 
Research Directions for Cross Reality Interfaces
Research Directions for Cross Reality InterfacesResearch Directions for Cross Reality Interfaces
Research Directions for Cross Reality Interfaces
 
Observability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetryObservability For You and Me with OpenTelemetry
Observability For You and Me with OpenTelemetry
 
The Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU CampusesThe Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU Campuses
 
Password Rotation in 2024 is still Relevant
Password Rotation in 2024 is still RelevantPassword Rotation in 2024 is still Relevant
Password Rotation in 2024 is still Relevant
 
[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf
[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf
[Talk] Moving Beyond Spaghetti Infrastructure [AOTB] 2024-07-04.pdf
 

MariaDB Server & MySQL Security Essentials 2016

  • 1. MariaDB/MySQL Security Essentials Colin Charles, Team MariaDB, MariaDB Corporation colin@mariadb.com / byte@bytebot.net http://bytebot.net/blog/ | @bytebot on Twitter FLOSSUK 2016, London 17 March 2016
  • 2. whoami • Work on MariaDB at MariaDB Corporation (SkySQL Ab) • Merged with Monty Program Ab, makers of MariaDB • Formerly MySQL AB (exit: Sun Microsystems) • Past lives include Fedora Project (FESCO), OpenOffice.org • MySQL Community Contributor of the Year Award winner 2014
  • 3. Historically… • No password for the ‘root’ user • There is a default ‘test’ database • Find a password from application config files (wp- config.php, drupal’s settings.php, etc.) • Are your datadir permissions secure (/var/lib/ mysql)? • can you run strings mysql/user.MYD ?
  • 4. Can you view privileges to find a user with more access? MariaDB [(none)]> SELECT host,user,password from mysql.user; +--------------+-------------------+----------+ | host | user | password | +--------------+-------------------+----------+ | localhost | root | | | sirius | root | | | 127.0.0.1 | root | | | ::1 | root | | | localhost | | | | sirius | | | +--------------+-------------------+----------+
  • 5. More things to think about • Does replication connection have global permissions? • If you can start/stop mysqld process, you can reset passwords • Can you edit my.cnf? You can run a SQL file when mysqld starts with init-file
  • 6. sql_mode • 5.6 default = NO_ENGINE_SUBSTITUTION • SQL_MODE = STRICT_ALL_TABLES, NO_ENGINE_SUBSTITUTION • Keeps on improving, like deprecating NO_ZERO_DATE, NO_ZERO_IN_DATE (5.6.17) and making it part of strict mode
  • 7. mysql_secure_installation • Pretty basic to run, but many don’t • Remove anonymous users • Remove test database • Remove non-localhost root users • Set a root password
  • 8. Creating users • The lazy way • CREATE USER ‘foo’@‘%’; • GRANT ALL ON *.* TO ‘foo’@‘%’; • The above gives you access to all tables in all databases + access from any external location • ALL gives you a lot of privileges, including SHUTDOWN, SUPER, CHANGE MASTER, KILL, USAGE, etc.
  • 9. SUPER privileges • Can bypass a read_only server • Can bypass init_connect • Can disable binary logging • Can dynamically change configuration • Reached max_connections? Can still make one connection • https://dev.mysql.com/ doc/refman/5.6/en/ privileges- provided.html#priv_super • SUPER Read Only: prohibit client updates for everyone
  • 10. So… only give users what they need • CREATE USER ‘foo’@‘localhost’ IDENTIFIED by ‘password’; • GRANT CREATE, SELECT, INSERT, UPDATE, DELETE on db.* to ‘foo’@‘localhost’;
  • 11. And when it comes to applications… • Viewer? (read only access only) • SELECT • User? (read/write access) • SELECT, INSERT, UPDATE, DELETE • DBA? (provide access to the database) • CREATE, DROP, etc.
  • 12. Installation • Using your Linux distribution… mostly gets you MariaDB when you ask for mysql-server • Except on Debian/Ubuntu • However, when you get mariadb-server, you get an authentication plugin — auth_socket for “automatic logins” • You are asked by debhelper to enter a password • You can use the APT/YUM repositories from Oracle MySQL, Percona or MariaDB • Don’t disable SELinux: system_u:system_r:mysqld_t:s0
  • 13. Enable log-warnings • Enable —log_warnings=2 • Can keep track of access denied messages • Worth noting there are differences here in MySQL & MariaDB • https://dev.mysql.com/doc/refman/5.6/en/server- options.html#option_mysqld_log-warnings • https://mariadb.com/kb/en/mariadb/server-system- variables/#log_warnings
  • 14. MySQL 5.6 improvements • Password expiry • ALTER USER 'foo'@'localhost' PASSWORD EXPIRE; • https://dev.mysql.com/doc/refman/5.6/en/ password-expiration-sandbox-mode.html • Password validation plugin • VALIDATE_PASSWORD_STRENGTH()
  • 15. MySQL 5.6 II • mysql_config_editor - store authentication credentials in an encrypted login path file named .mylogin.cnf • http://dev.mysql.com/doc/refman/5.6/en/mysql- config-editor.html • Random ‘root’ password on install • mysql_install_db —random-passwords stored in $HOME/.mysql_secret
  • 16. MySQL 5.7 • Improved password expiry — automatic password expiration available, so set default_password_lifetime in my.cnf • You can also require password to be changed every n- days • ALTER USER ‘foo'@'localhost' PASSWORD EXPIRE INTERVAL n DAY; • There is also account locking/unlocking now • ACCOUNT LOCK/ACCOUNT UNLOCK
  • 17. SSL • You’re using the cloud and you’re using replication… you don’t want this in cleartext • Setup SSL (note: yaSSL vs OpenSSL can cause issues) • https://dev.mysql.com/doc/refman/5.6/en/ssl- connections.html • Worth noting 5.7 has a new tool: mysql_ssl_rsa_setup
  • 18. Initialise data directory using mysqld now • mysql_install_db is deprecated in 5.7 • mysqld itself handles instance initialisation • mysqld —initialize • mysqld —initialize-insecure
  • 19. MariaDB passwords • Password validation plugin (finally) exists now • https://mariadb.com/kb/en/mariadb/development/mariadb- internals-documentation/password-validation/ • simple_password_check password validation plugin • can enforce a minimum password length and guarantee that a password contains at least a specified number of uppercase and lowercase letters, digits, and punctuation characters. • cracklib_password_check password validation plugin • Allows passwords that are strong enough to pass CrackLib test. This is the same test that pam_cracklib.so does
  • 21. What you do today • MySQL stores accounts in the user table of the my mysql database • CREATE USER ‘foo’@‘localhost’ IDENTIFIED BY ‘password’;
  • 22. select plugin_name, plugin_status from information_schema.plugins where plugin_type='authentication'; +-----------------------+---------------+ | plugin_name | plugin_status | +-----------------------+---------------+ | mysql_native_password | ACTIVE | | mysql_old_password | ACTIVE | +-----------------------+---------------+ 2 rows in set (0.00 sec)
  • 23. Subtle difference w/MariaDB & MySQL usernames • Usernames in MariaDB > 5.5.31? 80 character limit (which you have to reload manually) create user 'long12345678901234567890'@'localhost' identified by 'pass'; Query OK, 0 rows affected (0.01 sec) vs ERROR 1470 (HY000): String 'long12345678901234567890' is too long for user name (should be no longer than 16)
  • 24. Installing plugins • MariaDB: INSTALL SONAME ‘auth_socket’ • MySQL: INSTALL PLUGIN auth_socket SONAME ‘auth_socket.so’
  • 25. auth_socket • Authenticates against the Unix socket file • Uses so_peercred socket option to obtain information about user running client • CREATE USER ‘foo’@‘localhost’ IDENTIFIED with auth_socket; • Refuses connection of any other user but foo from connecting
  • 26. sha256_password • Default in 5.6, needs SSL-built MySQL (if using it, best to set it in my.cnf) • default-authentication-plugin=sha256_password • Default SSL is yaSSL, but with OpenSSL you get RSA encryption • client can transmit passwords to RSA server during connection • There exists key paths for private/public keys • Passwords never exposed as cleartext when connecting
  • 27. PAM Authentication • MySQL PAM • Percona PAM (auth_pam & auth_pam_compat) • MariaDB PAM (pam)
  • 28. Let’s get somethings out of the way • PAM = Pluggable Authentication Module • Use pam_ldap to to authenticate credentials against LDAP server — configure /etc/ pam_ldap.conf (you also obviously need /etc/ ldap.conf) • Simplest way is of course /etc/shadow auth
  • 29. Percona Server INSTALL PLUGIN auth_pam SONAME ‘auth_pam.so'; CREATE USER byte IDENTIFIED WITH auth_pam; In /etc/pam.d/mysqld: auth required pam_warn.so auth required pam_unix.so audit account required pam_unix.so audit
  • 30. MariaDB INSTALL SONAME ‘auth_pam’; CREATE USER byte IDENTIFIED via pam USING ‘mariadb’; Edit /etc/pam.d/mariadb: auth required pam_unix.so account required pam_unix.so
  • 31. For MySQL compatibility • Just use —pam-use-cleartext-plugin for MySQL to use mysql_cleartext_password instead of dialog plugin
  • 32. Possible errors • Connectors don’t support it: • Client does not support authentication protocol requested by server; consider upgrading MySQL client. • You may have to re-compile connector using libmysqlclient to have said support
  • 33. Kerberos • Every participant in authenticated communication is known as a ‘principal’ (w/unique name) • Principals belong to administrative groups called realms. Kerberos Distribution Centre maintains a database of principal in realm + associated secret keys • Client requests a ticket from KDC for access to a specific asset. KDC uses the client’s secret and the server’s secret to construct the ticket which allows the client and server to mutually authenticate each other, while keeping the secrets hidden.
  • 34. MariaDB Kerberos plugin • User principals: <username>@<KERBEROS REALM> • CREATE USER 'byte' IDENTIFIED VIA kerberos AS ‘byte/mariadb@lp'; • so that is <username>/ <instance>@<KERBEROS REALM> • Store Service Principal Name (SPN) is an option in a config file
  • 35. Works where? • GSSAPI-based Kerberos widely used & supported on Linux • Windows supports SSPI authentication and the plugin supports it • Comes with MariaDB Server 10.1
  • 36. 5.7 mysql_no_login • mysql_no_login - prevents all client connections to an account that uses it • https://dev.mysql.com/doc/refman/5.7/en/mysql- no-login-plugin.html
  • 38. SQL Error Logging Plugin • Log errors sent to clients in a log file that can be analysed later. Log file can be rotated (recommended) • a MYSQL_AUDIT_PLUGIN install plugin SQL_ERROR_LOG soname 'sql_errlog.so';
  • 39. Audit Plugin • Log server activity - who connects to the server, what queries run, what tables touched - rotating log file or syslogd • MariaDB has extended the audit API, so user filtering is possible • a MYSQL_AUDIT_PLUGIN INSTALL PLUGIN server_audit SONAME ‘server_audit.so’;
  • 40. Roles • Bundles users together, with similar privileges - follows the SQL standard CREATE ROLE audit_bean_counters; GRANT SELECT ON accounts.* to audit_bean_counters; GRANT audit_bean_counters to ceo;
  • 41. Encryption • Encryption: tablespace and table level encryption with support for rolling keys using the AES algorithm • table encryption — PAGE_ENCRYPTION=1 • tablespace encryption — encrypts everything including log files • New file_key_management_filename, file_key_management_filekey, file_key_management_encryption_algorithm • Well documented — https://mariadb.com/kb/en/mariadb/data-at- rest-encryption/
  • 42. Encryption II • The key file contains encryption keys identifiers (32-bit numbers) and hex-encoded encryption keys (128-256 bit keys), separated by a semicolon. • don’t forget to create keys! • eg. openssl enc -aes-256-cbc -md sha1 -k secret -in keys.txt -out keys.enc
  • 43. my.cnf config [mysqld] plugin-load-add=file_key_management.so file-key-management file-key-management-filename = /home/mdb/keys.enc innodb-encrypt-tables innodb-encrypt-log innodb-encryption-threads=4 aria-encrypt-tables=1 # PAGE row format encrypt-tmp-disk-tables=1 # this is for Aria
  • 44. Encryption III CREATE TABLE customer ( customer_id bigint not null primary key, customer_name varchar(80), customer_creditcard varchar(20)) ENGINE=InnoDB page_encryption=1 page_encryption_key=1;
  • 45. Encryption IV • Tablespace encryption (Google) • again, you need to pick an encryption algorithm • specify what to encrypt: innodb-encrypt-tables, aria, aria-encrypt-tables, encrypt-tmp- disk-tables, innodb-encrypt-log • don’t forget key rotation: • innodb-encryption-threads=4 • innodb-encryption-rotate-key-age=1800
  • 46. Encryption V • we also have tablespace scrubbing • background process that regularly scans through the tables and upgrades the encryption keys • scrubbing works for tablespaces and logs • —encrypt-tmp-files • —encrypt-binlog
  • 47. Encryption VI • /etc/my.cnf.d/enable_encryption.preset • Consider using Eperi Gateway for Databases • MariaDB Enterprise will have a plugin for Amazon Key Management Server (KMS) • mysqlbinlog has no way to read (i.e. decrypt) an encrypted binlog • This does not work with MariaDB Galera Cluster yet (gcache is not encrypted yet), and also xtrabackup needs additional work (i.e. if you encrypt the redo log)
  • 48. Preventing SQL Injections • MySQL Enterprise Firewall ($$$) • http://mysqlserverteam.com/new-mysql-enterprise- firewall-prevent-sql-injection-attacks/ • MaxScale Database Firewall filter (write your own regex) • https://mariadb.com/kb/en/mariadb-enterprise/ maxscale/maxscale-database-firewall-filter/ • https://mariadb.com/blog/maxscale-firewall-filter
  • 49. Resources • oak-security-audit • https://openarkkit.googlecode.com/svn/trunk/ openarkkit/doc/html/oak-security-audit.html • Securich • http://www.securich.com/ • Encrypting MySQL Data at Google - Jeremy Cole & Jonas Oreland • http://bit.ly/google_innodb_encryption
  • 50. Thank you! Colin Charles colin@mariadb.org / byte@bytebot.net http://bytebot.net/blog | @bytebot on twitter slides: slideshare.net/bytebot