Security Checklist

Run these steps to check for sufficient privileges.
- Try mysql -u root.
  - If connected successfully to the server without being asked for a password, anyone can connect to the MySQL server as the MySQL root user with full privileges!
- Use the SHOW GRANTS statement to check which accounts have access to what.
  - Then use the REVOKE statement to remove those privileges that are not necessary.

Run these steps to check the firewall.
- Scan ports from the Internet using a tool such as nmap.
  - Port 3306 should not be accessible from untrusted hosts.
    - MySQL uses port 3306 by default.
- Run telnet to connect to port 3306.
  - If a connection is establised, the port is open, and should be closed on the firewall or router.

Run these steps to check Web forms that access MySQL.
- Try to enter single and double quote marks in all Web forms.
  - Investigate and fix any problems right away.
- Try to modify dynamic URLs by adding %22 (‘"’), %23 (‘#’), and %27 (‘'’) to them.
- Try to enter characters, spaces, and special symbols rather than numbers in numeric fields.
- Check the size of data before passing it to MySQL.

What are the security-related mysqld options?

© 2007 John Michael Pierobon

Notes