<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="security-against-attack">
      </a>
      8.1.3 Making MySQL Secure Against Attackers
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045252803024">
  </a>
  <a class="indexterm" name="idm46045252801568">
  </a>
  <a class="indexterm" name="idm46045252800080">
  </a>
  <a class="indexterm" name="idm46045252799008">
  </a>
  <a class="indexterm" name="idm46045252797968">
  </a>
  <p>
   When you connect to a MySQL server, you should use a password. The
      password is not transmitted as cleartext over the connection.
  </p>
  <p>
   All other information is transferred as text, and can be read by
      anyone who is able to watch the connection. If the connection
      between the client and the server goes through an untrusted
      network, and you are concerned about this, you can use the
      compressed protocol to make traffic much more difficult to
      decipher. You can also use MySQL's internal SSL support to make
      the connection even more secure. See
   <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
    Section 8.3, “Using Encrypted Connections”
   </a>
   . Alternatively, use SSH to
      get an encrypted TCP/IP connection between a MySQL server and a
      MySQL client. You can find an Open Source SSH client at
   <a class="ulink" href="http://www.openssh.org/" target="_blank">
    http://www.openssh.org/
   </a>
   , and a comparison of both
      Open Source and Commercial SSH clients at
   <a class="ulink" href="http://en.wikipedia.org/wiki/Comparison_of_SSH_clients" target="_blank">
    http://en.wikipedia.org/wiki/Comparison_of_SSH_clients
   </a>
   .
  </p>
  <p>
   To make a MySQL system secure, you should strongly consider the
      following suggestions:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Require all MySQL accounts to have a password. A client
          program does not necessarily know the identity of the person
          running it. It is common for client/server applications that
          the user can specify any user name to the client program. For
          example, anyone can use the
      <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
       <span class="command">
        <strong>
         mysql
        </strong>
       </span>
      </a>
      program
          to connect as any other person simply by invoking it as
      <code class="literal">
       mysql -u
       <em class="replaceable">
        <code>
         other_user
        </code>
       </em>
       <em class="replaceable">
        <code>
         db_name
        </code>
       </em>
      </code>
      if
      <em class="replaceable">
       <code>
        other_user
       </code>
      </em>
      has no password. If all
          accounts have a password, connecting using another user's
          account becomes much more difficult.
     </p>
     <p>
      For a discussion of methods for setting passwords, see
      <a class="xref" href="assigning-passwords.html" title="8.2.14 Assigning Account Passwords">
       Section 8.2.14, “Assigning Account Passwords”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Make sure that the only Unix user account with read or write
          privileges in the database directories is the account that is
          used for running
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Never run the MySQL server as the Unix
      <code class="literal">
       root
      </code>
      user. This is extremely dangerous, because any user with the
      <a class="link" href="privileges-provided.html#priv_file">
       <code class="literal">
        FILE
       </code>
      </a>
      privilege is able to cause
          the server to create files as
      <code class="literal">
       root
      </code>
      (for
          example,
      <code class="literal">
       ~root/.bashrc
      </code>
      ). To prevent this,
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      refuses to run as
      <code class="literal">
       root
      </code>
      unless that is specified explicitly
          using the
      <a class="link" href="server-options.html#option_mysqld_user">
       <code class="option">
        --user=root
       </code>
      </a>
      option.
     </p>
     <p>
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      can (and should) be run as an
          ordinary, unprivileged user instead. You can create a separate
          Unix account named
      <code class="literal">
       mysql
      </code>
      to make everything
          even more secure. Use this account only for administering
          MySQL. To start
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      as a different Unix
          user, add a
      <code class="literal">
       user
      </code>
      option that specifies the
          user name in the
      <code class="literal">
       [mysqld]
      </code>
      group of the
      <code class="filename">
       my.cnf
      </code>
      option file where you specify
          server options. For example:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa75167223"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">user</span><span class="token attr-value"><span class="token punctuation">=</span>mysql</span></code></pre>
     </div>
     <p>
      This causes the server to start as the designated user whether
          you start it manually or by using
      <a class="link" href="mysqld-safe.html" title="6.3.2 mysqld_safe — MySQL Server Startup Script">
       <span class="command">
        <strong>
         mysqld_safe
        </strong>
       </span>
      </a>
      or
      <a class="link" href="mysql-server.html" title="6.3.3 mysql.server — MySQL Server Startup Script">
       <span class="command">
        <strong>
         mysql.server
        </strong>
       </span>
      </a>
      . For more details, see
      <a class="xref" href="changing-mysql-user.html" title="8.1.5 How to Run MySQL as a Normal User">
       Section 8.1.5, “How to Run MySQL as a Normal User”
      </a>
      .
     </p>
     <p>
      Running
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      as a Unix user other than
      <code class="literal">
       root
      </code>
      does not mean that you need to change
          the
      <code class="literal">
       root
      </code>
      user name in the
      <code class="literal">
       user
      </code>
      table.
      <span class="emphasis">
       <em>
        User names for MySQL
          accounts have nothing to do with user names for Unix
          accounts
       </em>
      </span>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Do not grant the
      <a class="link" href="privileges-provided.html#priv_file">
       <code class="literal">
        FILE
       </code>
      </a>
      privilege
          to nonadministrative users. Any user that has this privilege
          can write a file anywhere in the file system with the
          privileges of the
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      daemon. This
          includes the server's data directory containing the files that
          implement the privilege tables. To make
      <a class="link" href="privileges-provided.html#priv_file">
       <code class="literal">
        FILE
       </code>
      </a>
      -privilege operations a bit
          safer, files generated with
      <a class="link" href="select-into.html" title="15.2.13.1 SELECT ... INTO Statement">
       <code class="literal">
        SELECT ... INTO
          OUTFILE
       </code>
      </a>
      do not overwrite existing files and are
          writable by everyone.
     </p>
     <a class="indexterm" name="idm46045252756304">
     </a>
     <p>
      The
      <a class="link" href="privileges-provided.html#priv_file">
       <code class="literal">
        FILE
       </code>
      </a>
      privilege may also be
          used to read any file that is world-readable or accessible to
          the Unix user that the server runs as. With this privilege,
          you can read any file into a database table. This could be
          abused, for example, by using
      <a class="link" href="load-data.html" title="15.2.9 LOAD DATA Statement">
       <code class="literal">
        LOAD
          DATA
       </code>
      </a>
      to load
      <code class="filename">
       /etc/passwd
      </code>
      into a
          table, which then can be displayed with
      <a class="link" href="select.html" title="15.2.13 SELECT Statement">
       <code class="literal">
        SELECT
       </code>
      </a>
      .
     </p>
     <p>
      To limit the location in which files can be read and written,
          set the
      <a class="link" href="server-system-variables.html#sysvar_secure_file_priv">
       <code class="literal">
        secure_file_priv
       </code>
      </a>
      system to a specific directory. See
      <a class="xref" href="server-system-variables.html" title="7.1.8 Server System Variables">
       Section 7.1.8, “Server System Variables”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Encrypt binary log files and relay log files. Encryption helps
          to protect these files and the potentially sensitive data
          contained in them from being misused by outside attackers, and
          also from unauthorized viewing by users of the operating
          system where they are stored. You enable encryption on a MySQL
          server by setting the
      <a class="link" href="replication-options-binary-log.html#sysvar_binlog_encryption">
       <code class="literal">
        binlog_encryption
       </code>
      </a>
      system
          variable to
      <code class="literal">
       ON
      </code>
      . For more information, see
      <a class="xref" href="replication-binlog-encryption.html" title="19.3.2 Encrypting Binary Log Files and Relay Log Files">
       Section 19.3.2, “Encrypting Binary Log Files and Relay Log Files”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Do not grant the
      <a class="link" href="privileges-provided.html#priv_process">
       <code class="literal">
        PROCESS
       </code>
      </a>
      or
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege to
          nonadministrative users. The output of
      <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
       <span class="command">
        <strong>
         mysqladmin
          processlist
        </strong>
       </span>
      </a>
      and
      <a class="link" href="show-processlist.html" title="15.7.7.31 SHOW PROCESSLIST Statement">
       <code class="literal">
        SHOW
          PROCESSLIST
       </code>
      </a>
      shows the text of any statements
          currently being executed, so any user who is permitted to see
          the server process list might be able to see statements issued
          by other users.
     </p>
     <p>
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      reserves an extra connection for
          users who have the
      <a class="link" href="privileges-provided.html#priv_connection-admin">
       <code class="literal">
        CONNECTION_ADMIN
       </code>
      </a>
      or
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege, so that a
          MySQL
      <code class="literal">
       root
      </code>
      user can log in and check server
          activity even if all normal connections are in use.
     </p>
     <p>
      The
      <a class="link" href="privileges-provided.html#priv_super">
       <code class="literal">
        SUPER
       </code>
      </a>
      privilege can be used
          to terminate client connections, change server operation by
          changing the value of system variables, and control
          replication servers.
     </p>
    </li>
    <li class="listitem">
     <p>
      Do not permit the use of symlinks to tables. (This capability
          can be disabled with the
      <a class="link" href="server-options.html#option_mysqld_symbolic-links">
       <code class="option">
        --skip-symbolic-links
       </code>
      </a>
      option.) This is especially important if you run
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      as
      <code class="literal">
       root
      </code>
      , because
          anyone that has write access to the server's data directory
          then could delete any file in the system! See
      <a class="xref" href="symbolic-links-to-tables.html" title="10.12.2.2 Using Symbolic Links for MyISAM Tables on Unix">
       Section 10.12.2.2, “Using Symbolic Links for MyISAM Tables on Unix”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Stored programs and views should be written using the security
          guidelines discussed in
      <a class="xref" href="stored-objects-security.html" title="27.6 Stored Object Access Control">
       Section 27.6, “Stored Object Access Control”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      If you do not trust your DNS, you should use IP addresses
          rather than host names in the grant tables. In any case, you
          should be very careful about creating grant table entries
          using host name values that contain wildcards.
     </p>
    </li>
    <li class="listitem">
     <p>
      If you want to restrict the number of connections permitted to
          a single account, you can do so by setting the
      <a class="link" href="server-system-variables.html#sysvar_max_user_connections">
       <code class="literal">
        max_user_connections
       </code>
      </a>
      variable
          in
      <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
       <span class="command">
        <strong>
         mysqld
        </strong>
       </span>
      </a>
      . The
      <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
       <code class="literal">
        CREATE
          USER
       </code>
      </a>
      and
      <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
       <code class="literal">
        ALTER USER
       </code>
      </a>
      statements also support resource control options for limiting
          the extent of server use permitted to an account. See
      <a class="xref" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
       Section 15.7.1.3, “CREATE USER Statement”
      </a>
      , and
      <a class="xref" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
       Section 15.7.1.1, “ALTER USER Statement”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      If the plugin directory is writable by the server, it may be
          possible for a user to write executable code to a file in the
          directory using
      <a class="link" href="select.html" title="15.2.13 SELECT Statement">
       <code class="literal">
        SELECT
          ... INTO DUMPFILE
       </code>
      </a>
      . This can be prevented by making
      <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
       <code class="literal">
        plugin_dir
       </code>
      </a>
      read only to the
          server or by setting
      <a class="link" href="server-system-variables.html#sysvar_secure_file_priv">
       <code class="literal">
        secure_file_priv
       </code>
      </a>
      to a
          directory where
      <a class="link" href="select.html" title="15.2.13 SELECT Statement">
       <code class="literal">
        SELECT
       </code>
      </a>
      writes
          can be made safely.
     </p>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
