MySQL Security Hardening Checklist

1. Initial Setup and Configuration

• Run MySQL secure installation script
  • sudo mysql_secure_installation
• Change MySQL root password
  • Use a strong, unique password
  • Consider using a password manager
• Remove anonymous users
• Disable remote root login
• Remove test database and access to it

2. User Account Management

• Create individual user accounts for each application or service
• Grant only necessary privileges to each user
  • Use principle of least privilege
  • Avoid granting GRANT option to non-administrative users
• Regularly audit user accounts and privileges
  • Remove unused accounts
  • Revoke unnecessary privileges
• Use strong passwords for all accounts
• Implement password policies (complexity, expiration)

3. Network Security

• Bind MySQL to localhost if remote access is not required
  • Edit my.cnf: bind-address = 127.0.0.1
• If remote access is needed, use a firewall to restrict access
  • Allow connections only from trusted IP addresses
• Use SSL/TLS for encrypted connections
  • Generate SSL certificates
  • Configure MySQL to use SSL
  • Require SSL for specific users or all users
• Disable MySQL port in the firewall if not needed externally

4. File System Security

• Set appropriate file permissions for MySQL data directory
  • chown -R mysql:mysql /var/lib/mysql/
  • chmod -R 750 /var/lib/mysql/
• Secure MySQL configuration files
  • chown root:root /etc/my.cnf
  • chmod 644 /etc/my.cnf
• Disable LOCAL INFILE if not needed
  • Add to my.cnf: local-infile=0
• Encrypt sensitive data at rest

5. Logging and Auditing

• Enable MySQL error log
  • Add to my.cnf: log-error=/var/log/mysql/error.log
• Enable general query log for auditing (use cautiously due to performance impact)
  • Add to my.cnf: general_log=1 and general_log_file=/var/log/mysql/query.log
• Enable binary logging for point-in-time recovery
  • Add to my.cnf: log-bin=/var/log/mysql/mysql-bin.log
• Regularly review and analyze logs
• Implement log rotation to manage log file sizes

6. Regular Maintenance

• Keep MySQL server software up to date
  • Regularly check for and apply security updates
• Regularly backup databases
  • Test backup restoration process
• Perform regular security audits
• Monitor for unusual activity or performance issues

7. Additional Security Measures

• Implement query rate limiting to prevent DoS attacks
• Use prepared statements in application code to prevent SQL injection
• Consider using a Web Application Firewall (WAF) for additional protection
• Implement database activity monitoring

Related Checklists

• LAMP Stack Setup Checklist