Securing MySQL Server Best Practice

1. Disable all anonymous login
   mysql>select user,host,password from mysql.user;
   it should have hashed password
   – Remove all anonymous password or create password for all account or r
   mysql>revoke all on *.* from user@localhost;

2. Restrict remote login
   – Disable all remote @% user account
   – Bind only to localhost edit my.cnf -> bind-address = 127.0.0.1
   – edit my.cnf -> skip-networking
3. Dont run mysqld as root, run as another user uid/guid for example: mysql
4. Disable loading local files
   edit my.cnf add local-infile=0
5. Use ssh tunnel for database query or adminitration
6. Enable logging in my.cnf :
   [mysqld]
   log=/var/log/mysql-logfile
   – chmod make sure its unreadable -rw-r—–
7. Create spesific user for each app
   mysql> create user 'opencart'@'localhost' identified by 'password';
mysql> grant select,update,delete on opencartdb.* to 'opencart'@'localhost';
   – or grant it all:
   mysql> grant all on opencartdb.* to 'opencart'@'localhost';
8. change root login with uncommon name
   mysql> rename user 'root'@'localhost' to 't00r'@'localhost';
mysql> flush privileges
9. change default port 3306 in my.cnf -> port=6303
10. create unbreakable password combination with alphanumeric and symbol
    this would take some time for bruteforce :
    mysql> set password for t00r@localhost=password('x^8#ub&wgxQrw0f4k93jrChy7i%%cr*83v_:p');
11. detect mysql ddos, see session connection block it in firewall if necessary
    mysql> show status;
mysql>show processlist;
12. Limit number of maximum connection for each user