经验谈之MySQL安全问题的一点心得_MySQL
前两天在帮朋友整理他的主页空间时候,发现的一点关于MySQL可能大家都会忽略的问题:我们知道,在安装完MySQL后,它会自动创建一个root用户和一个匿名用户,其初始密码都是空,对于前者,很多参考资料上都会提醒大家要注意及时设定一个密码,而忽略了后者,大概是因为后者默认设定为只能在本机使用的缘故吧。 Eu,idWG
.1T9C=
但如果你的MySQL是要提供给Web服务器作数据库服务的,忽略这个匿名用户的代价可能相当惨重,因为在默认设置下,这个匿名用户在localhost上几乎拥有和root一样的权限,这时候,如果你的客户拥有上传脚本文件、脚本文件可以进行MySQL数据库操作(比如允许操作MySQL的php)的权限已经可能将你的MySQL改动得面目全非了: H xqSnXIrf
]sljuwG_
我今天帮朋友整理他的主页空间的时候,试着写了一个很简单的执行sql语句的php文件上传上去,其中连接字中的user,password我都试着置空,host=localhost,结果发现我的sql语句可以执行,于是执行select * from MySQL.user察看用户权限,发现这个用户在localhost权限非常高,连grant_priv都有,(察看的时候,会发现在root用户下有两行用户名、密码为空的,但各项权限有y 的,就是这个匿名用户本地、远程权限设置了) N ]]ms
2f_-&hhU
所以我试着用这个php页面创建一个新用户,并grant给他较高的权限,结果一举成功,这样我就可以用这个新用户通过我本机的MySQL client连接到这个网站的MySQL server,并用这个新建立的用户的管理权限对这个网站的MySQL server进行管理,看到自己可以进行这样轻易获得深入的数据库操作,我怎么还敢把朋友的主页空间的敏感资料放入这个MySQL server呢? S> PLm}0
{Ri
改进建议: GNe=Ar8
],? WS{
1、在安装完成MySQL 后,不仅改变root用户的的密码,也同时改变匿名用户的密码,方法类似改变root的密码的方式: _ I!xM_Yr
3Os+j+r@
MySQL> UPDATE user set password=PASSWORD(´yournewpassword´) where user=´´; i dX"$T+f
MySQL>FLUSH PRIVILEGES; [&4NS-F;P
"5N 5 5|-}
2、如非必要,删除这个匿名用户,这样所有人要使用MySQL 都必须提供用户名,即便日后出了问题,也容易查找问题的源头。 ji??)QZs
t 6C6hk
3、除了root用户外,其他用户包括匿名用户(如果没有删除这个用户)不应该拥有grant权限,防止管理权限不受控制的扩散出去。 C0fXOO"y"t
#B T I6W
4、赋予用户updatedeletealertcreatedrop权限的时候,应该限定到特定的数据库,尤其要避免普通客户拥有对MySQL数据库做操作的权限,否则你的系统设置很可能被替换掉。 HxTC$:/
Fzru24^
5、检查MySQL.user表,取消不必要用户的shutdown_priv,reload_priv,process_priv和File_priv权限,这些权限可能泄漏更多的服务器信息包括非MySQL的其它信息出去。 t-_[3#;
+__8*bLLR
6、如果不打算让你的用户使用MySQL数据库,在提供诸如php这样的脚本语言的时候,重新设置或编译你的php,取消它们对MySQL的默认支持。

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

The main role of MySQL in web applications is to store and manage data. 1.MySQL efficiently processes user information, product catalogs, transaction records and other data. 2. Through SQL query, developers can extract information from the database to generate dynamic content. 3.MySQL works based on the client-server model to ensure acceptable query speed.

The process of starting MySQL in Docker consists of the following steps: Pull the MySQL image to create and start the container, set the root user password, and map the port verification connection Create the database and the user grants all permissions to the database

Laravel is a PHP framework for easy building of web applications. It provides a range of powerful features including: Installation: Install the Laravel CLI globally with Composer and create applications in the project directory. Routing: Define the relationship between the URL and the handler in routes/web.php. View: Create a view in resources/views to render the application's interface. Database Integration: Provides out-of-the-box integration with databases such as MySQL and uses migration to create and modify tables. Model and Controller: The model represents the database entity and the controller processes HTTP requests.

I encountered a tricky problem when developing a small application: the need to quickly integrate a lightweight database operation library. After trying multiple libraries, I found that they either have too much functionality or are not very compatible. Eventually, I found minii/db, a simplified version based on Yii2 that solved my problem perfectly.

The key to installing MySQL elegantly is to add the official MySQL repository. The specific steps are as follows: Download the MySQL official GPG key to prevent phishing attacks. Add MySQL repository file: rpm -Uvh https://dev.mysql.com/get/mysql80-community-release-el7-3.noarch.rpm Update yum repository cache: yum update installation MySQL: yum install mysql-server startup MySQL service: systemctl start mysqld set up booting

Installing MySQL on CentOS involves the following steps: Adding the appropriate MySQL yum source. Execute the yum install mysql-server command to install the MySQL server. Use the mysql_secure_installation command to make security settings, such as setting the root user password. Customize the MySQL configuration file as needed. Tune MySQL parameters and optimize databases for performance.

Article summary: This article provides detailed step-by-step instructions to guide readers on how to easily install the Laravel framework. Laravel is a powerful PHP framework that speeds up the development process of web applications. This tutorial covers the installation process from system requirements to configuring databases and setting up routing. By following these steps, readers can quickly and efficiently lay a solid foundation for their Laravel project.

Compared with other programming languages, MySQL is mainly used to store and manage data, while other languages such as Python, Java, and C are used for logical processing and application development. MySQL is known for its high performance, scalability and cross-platform support, suitable for data management needs, while other languages have advantages in their respective fields such as data analytics, enterprise applications, and system programming.
