Overview
Databases are a favourite target because they often hold your most sensitive data. This article walks through the essential hardening steps for MySQL or MariaDB on a Pod.
Before you begin
- Root or sudo access, plus your database root password.
- A current backup before making changes.
Steps
- Run the secure installation script to remove unsafe defaults:
bash
sudo mysql_secure_installation
Set a root password if prompted, remove anonymous users, disallow remote root login, remove the test database, and reload privileges.
- Do not expose the database to the internet. By default it should listen only on localhost. Check with:
bash
sudo ss -tulpn | grep -E '3306|mysql'
If you must serve remote clients, bind to a private/VPN address in /etc/mysql/mariadb.conf.d/50-server.cnf:
bind-address = 10.8.0.1
- Use dedicated users with least privilege instead of the root account for applications:
sql
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'strong-password';
GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;
- Remove remote access from accounts that do not need it. Check the host part of each user with:
sql
SELECT user, host FROM mysql.user;
- Disable
LOCAL INFILEin your server config to prevent file reads/writes via SQL:
local-infile = 0
Restrict file system access. Ensure the data directory is owned by the
mysqluser and not world-readable.Keep it patched and enable the firewall so port 3306 is never open publicly:
bash
sudo ufw deny 3306
Troubleshooting
- Problem: An application can no longer connect. Solution: Verify the user's
hostvalue matches where the app connects from and that the password is correct. - Problem:
mysql_secure_installationcannot authenticate. Solution: On some installs root uses socket authentication; run it viasudo mysql_secure_installationas the system root user.
Related articles
- [Using a VPN for private access]
- [Incident response: what to do if you are compromised]
- [Security best practices for your Pod]
