Linux Server Security (2nd Edition( [Electronic resources] نسخه متنی

Chapter 8. Database Security

The "M" in LAMP, and the most
popular open source database for
Linux, is
MySQL.
It's easy to install and configure, runs light, and
is quite fast. You'll commonly see it harnessed to
Apacheserving up site content and authenticating users
and offering a tempting target to those with more time than
sense or conscience. In this chapter, we'll apply to
database servers some of the methods we use to secure web servers,
email servers, and nameservers. It's a little
shorter than many of the other chapters because a database server is,
from a security viewpoint, simpler than a web server or email server.

Working from the outside into the crunchy database center,
we'll cover:

The types of security problems. What should you worry about?

Server placement. Where should you put your MySQL server to protect
it from TCP exploits? How can you provide secure access for database
clients?

Database server installation. What version of MySQL should you use?
What are the best file/directory ownerships and modes?

Database configuration. How do you create database user accounts and
grant permissions?

Database operation. How do you protect against malicious SQL and
bonehead queries? What are good practices for logging and backup?

For one reason or another, you might want to consider an alternative
to MySQL. You can dip your toes in the
commercial database waters
(Oracle,
DB2/UDB,
Sybase) or stay in
the open source pool. At the top of the open source list is
PostgreSQL
(http://www.postgresql.org/),
which has more of the features of the big commercial relational
databasesviews, triggers, referential integrity, subselects,
stored procedures, and so on (although many of these features are
coming to MySQL). Firebird (http://firebird.sourceforge.net/) is a
spin-off of
Borland's InterBase.
Computer Associates has said it will release Ingres as open source
(http://opensource.ca.com/projects/ingres/).
SQLite (http://www.sqlite.org/) is an embeddable
database that may become more well-known from its inclusion in recent
releases of PHP.

You might also consider LDAP (Chapter 7).
If your main use of a database is for user authentication and you
don't need SQL, LDAP may be a faster and simpler
solution.