ITN Wake Tech1 ITN270 Advanced Internet Databases Lecture 16. Security, Database Backups, Maintenance & Repair Topics: – Internal Security – External Security –Backups –Maintenance & Repair

ITN Wake Tech2 Internal Security Issues related to file access authorizations –Server Binary Files Only Administrator can access –Client programs Accessible to users so they can run the programs –Files created after the initial installation (option files, SSL-related files, database directory) Administrator

ITN Wake Tech3 Internal Security Access to files in data directory How to steal data –Six steps (Refer to your textbook) Securing Your MySQL Installation –Change owner for the following directory except the data directory #chown -R root.mysqlgrp /usr/local/mysql #chown -R mysqladm.mysqlgrp /usr/local/mysql/data

ITN Wake Tech4 Internal Security Change the mode of base directory & its subdirectory: –chmod 755 /usr/local/mysql mysqladm has full access and everyone else has only read and execute permission –chmod 755 /usr/local/mysql/bin –chmod 700 /usr/local/mysql/libexec clients do not have permission to access –change mode of data directory chmod -R go-rwx /usr/local/mysql/data –only account for running the server can directly access the data directory

ITN Wake Tech5 Internal Security Securing the Socket File –for connection by the client to the local host –change the mode so that users can only remove the files they created Securing Option files –should not be exposed

ITN Wake Tech6 External Security GRANT & REVOKE statements to set up & modify user access to MySQL Structure & Contents of Grant Tables:

ITN Wake Tech7 External Security Structure & Contents of Grant Tables: –user accounts for users may connect to the server password, global privileges - apply to all databases –db which accounts have privileges for which databases Privileges apply to all tables in a database –tables_priv table level privileges apply to all columns in a table –columns_priv column-level privilege

ITN Wake Tech8 Setting up MySQL accounts Without GRANT Statements Modify the grant tables directly Examples: –GRANT ALL ON *.* TO IDENTIFIED BY ‘password’ WITH GRANT OPTION –INSERT INTO user VALUES(‘localhost’, ‘userid’, PASSWORD(‘password’), ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’);

ITN Wake Tech9 Setting Up Secure Connections Localhost –No need to have SSL in the connection Remote access: –GRANT ALL ON finance.* TO IDENTIFIED BY ‘password’ REQUIR SSL,

ITN Wake Tech10 Locking a database/table for read Lock a Table –LOCK TABLE tb_name READ RELEASE TABLE LOCK –UNLOCK TABLE; Locking All Database for READ access –FLUSH TABLES WITH READ LOCK RELEASE the LOCK –UNLOCK TABLES;

ITN Wake Tech11 Database Backups %mysqlsump *.* > filename direct copy –cp /usr/local/mysql/data/? Filename

ITN Wake Tech12 Table Repair and Data Recovery Checking & Reparing Database Tables –Checking - myisamchk myisamchk tbl_name myisamchk --check tbl_name –Reparing - myisamchk myisamchk --recover --quick tbl_name myisamchk --recover tbl_name myisamchk --safe-recover tble_name

ITN Wake Tech13 Table Repair and Data Recovery Checking & Reparing Tables Using the Server –CHECK mysqlcheck db_name; mysqlcheck db_name tb_name1, tb_name2 mysqlcheck --database db_name1 db_name2 mysqlcheck --all-databases –REPAIR mysqlcheck --repair ?? mysqlcheck --repair --quick ?? Mysqlcheck --repair --extended ??

ITN Wake Tech14 Table Repair and Data Recovery Recovering an entire database –Logfiles