MySQL Enterprise Monitor 8.0 Release Notes
This section describes the Security Advisors.
Note
MySQL Enterprise Firewall and MySQL Enterprise Audit Plug-in advisors are described in MySQL Enterprise Firewall and MySQL Enterprise Audit Plugin.
Prior to MySQL 4.1, password hashes computed by the PASSWORD() function were 16 bytes long. As of MySQL 4.1 (and later), PASSWORD() was modified to produce a longer 41-byte hash value to provide enhanced security.
Default frequency 06:00:00
Default auto-close enabled no
MySQL supports many forms of authentication as of the 5.5 release, including external authentication mechanisms using PAM, or Windows native authentication with commercial releases of MySQL version 5.5.16 or greater. If a user is configured to use an authentication plug-in, and that plug-in does not get loaded with server start, this blocks access to the database for those users.
Default frequency 06:00:00
Default auto-close enabled yes
Note
This advisor does not evaluate against MySQL 8, or higher.
Prior to MySQL 4.1, password hashes computed by the PASSWORD() function were 16 bytes long. As of MySQL 4.1 (and later), PASSWORD() was modified to produce a longer 41-byte hash value to provide enhanced security. However, in order to allow backward-compatibility with user tables that have been migrated from pre-4.1 systems, you can configure MySQL to accept logins for accounts that have password hashes created using the old, less-secure PASSWORD() function, but this is not recommended.
Default frequency 06:00:00
Default auto-close enabled no
Prior to MySQL 4.1, password hashes computed by the PASSWORD() function were 16 bytes long. As of MySQL 4.1 (and later), PASSWORD() was modified to produce a longer 41-byte hash value to provide enhanced security. In order to allow backward-compatibility with older client programs, you can configure MySQL to generate short (pre-4.1) password hashes for new passwords, however, this is not recommended.
Default frequency 06:00:00
Default auto-close enabled no
The LOAD DATA statement can load a file that
is located on the server host, or it can load a file that is
located on the client host when the LOCAL
keyword is specified.
There are two potential security issues with supporting the
LOCAL version of LOAD DATA
statements:
The transfer of the file from the client host to the server host is initiated by the MySQL server. In theory, a patched server could be built that would tell the client program to transfer a file of the server's choosing rather than the file named by the client in the
LOAD DATAstatement. Such a server could access any file on the client host to which the client user has read access.In a Web environment where the clients are connecting from a separate web server, a user could use
LOAD DATA LOCALto read any files that the web server process has read access to (assuming that a user could run any statement against the SQL server). In this environment, the client with respect to the MySQL server actually is the web server, not the remote program being run by the user who connects to the web server.
For more information, see LOAD DATA Statement.
Default frequency 00:05:00
Default auto-close enabled no
If users create weak passwords it compromises the security of
the server, making it easier for unauthorized people to guess
the password and gain access to the server. Starting with MySQL
Server 5.6, MySQL offers the
validate_password plug-in that can be used to
test passwords and improve security. With this plug-in you can
implement and enforce a policy for password strength (e.g.
passwords must be at least 8 characters long, have both
lowercase and uppercase letters, contain at least one special
non-alphanumeric character, and do not match commonly-used
words).
For more information on validate_password
plug-in, see The Password Validation Component.
Default frequency 06:00:00
Default auto-close enabled no
If users create weak passwords, it compromises the security of
the server, making it easier for unauthorized people to guess
the password and gain access to the server. Starting with MySQL
Server 5.6, MySQL offers the
validate_password plug-in that can be used to
test passwords and improve security. With this plug-in you can
implement and enforce a policy for password strength (e.g.
passwords must be at least 8 characters long, have both
lowercase and uppercase letters, and contain at least one
special non-alphanumeric character).
For more information on validate_password
plug-in, see The Password Validation Component.
Default frequency 06:00:00
Default auto-close enabled no
If users create weak passwords, it compromises the security of
the server, making it easier for unauthorized people to guess
the password and gain access to the server. Starting with MySQL
Server 5.6, MySQL offers the
validate_password plug-in that can be used to
test passwords and improve security. With this plug-in you can
implement and enforce a policy for password strength (e.g.
passwords must be at least 8 characters long, have both
lowercase and uppercase letters, and contain at least one
special non-alphanumeric character).
For more information on validate_password
plug-in, see The Password Validation Component.
Default frequency 06:00:00
Default auto-close enabled no
For development environments, changes to database security privileges may be a normal occurrence, but for production environments it is wise to know when any security changes occur with respect to database privileges, and to ensure that those changes are authorized and required.
Default frequency 00:05:00
Default auto-close enabled no
For development environments, changes to database security privileges may be a normal occurrence, but for production environments it is wise to know when any security changes occur with respect to database privileges, and to ensure that those changes are authorized and required.
Default frequency 00:05:00
Default auto-close enabled no
For development environments, changes to database security privileges may be a normal occurrence, but for production environments it is wise to know when any security changes occur with respect to database privileges, and to ensure that those changes are authorized and required.
Default frequency 00:05:00
Default auto-close enabled no
By default, MySQL includes a root account with unlimited privileges that is typically used to administer the MySQL server. If possible, accounts with this much power should not allow remote logins in order to limit access to only those users able to login to the machine on which MySQL is running. This helps prevent unauthorized users from accessing and changing the system.
Default frequency 00:05:00
Default auto-close enabled no
The root user account has unlimited privileges and is intended for administrative tasks. Privileged accounts should have strong passwords to prevent unauthorized users from accessing and changing the system.
Default frequency 00:05:00
Default auto-close enabled yes
To help keep the server secure, each user's password is encrypted, and the stronger the encryption method, the more secure the server is. Starting with MySQL Server 5.6, MySQL offers a new encryption algorithm that performs authentication using SHA-256 password hashing. This is stronger encryption than that available with native authentication.
Default frequency 06:00:00
Default auto-close enabled no
By default, MySQL comes with a database named
test that anyone can access. This database is
intended only for testing and should be removed before moving
into a production environment. Because the default
test database can be accessed by any user and
has permissive privileges, it should be dropped immediately as
part of the installation process.
Default frequency 00:05:00
Default auto-close enabled no
Accounts without passwords are particularly dangerous because an attacker needs to guess only a username. Assigning passwords to all accounts helps prevent unauthorized users from accessing the system.
Default frequency 00:05:00
Default auto-close enabled yes
Anonymous MySQL accounts allow clients to connect to the server without specifying a username. Since anonymous accounts are well known in MySQL, removing them helps prevent unauthorized users from accessing the system.
Note
This advisor differentiates between anonymous accounts and proxy users. For more information on proxy users, see Proxy Users.
Default frequency 00:05:00
Default auto-close enabled yes
MySQL 5.5 supports both built-in authentication and external authentication via other methods such as PAM (LDAP, Unix user authentication) and Windows native authentication. However, if all 'root' users are configured to use external authentication, if this external authentication were to fail (such as the LDAP server losing power), then all administrator access to the MySQL Server is denied.
Default frequency 06:00:00
Default auto-close enabled no
By default, MySQL includes a root account with unlimited
privileges that is typically used to administer the MySQL
server. There is no reason this account must be named
root. Accounts with this much power should
not be easily discovered. Since the root account is well known
in MySQL, changing its name helps prevent unauthorized users
from accessing and changing the system.
Default frequency 00:05:00
Default auto-close enabled no
You can move tables and databases from the database directory to other locations and replace them with symbolic links to the new locations. You might want to do this, for example, to move a database to a file system with more free space or to increase the speed of your system by spreading your tables to different disks.
However, symlinks can compromise security. This is especially important if you run mysqld as root, because anyone who has write access to the server's data directory could then delete any file in the system!
Default frequency 06:00:00
Default auto-close enabled no
When a database is dropped, user privileges on the database are not automatically dropped. This has security implications as that user regains privileges if a database with the same name is created in the future, which may not be the intended result.
Default frequency 00:05:00
Default auto-close enabled no
When a table is dropped, user privileges on the table are not automatically dropped. This has security implications as that user regains privileges if a table with the same name in the same database is created in the future, which may not be the intended result.
Default frequency 00:05:00
Default auto-close enabled no
The SHOW DATABASES privilege should be granted only to users who
need to see all the databases on a MySQL Server. It is
recommended that the MySQL Server be started with the
--skip-show-database option
enabled to prevent anyone from using the SHOW DATABASES
statement unless they have been specifically granted the SHOW
DATABASES privilege.
Note
If a user is granted any global privilege, such as CREATE
TEMPORARY TABLES or LOCK TABLES, they are automatically given
the ability to show databases unless the server is started
with the --skip-show-database option
enabled. DBAs should be aware of this fact, in the event that
any applications make use of temporary tables.
Default frequency 00:05:00
Default auto-close enabled no