MySQL Security

SSL

Always use REQUIRE ad be specific (at least ISSUER maybe SUBJECT)
disable weak cioher
different keys cers for each client and server

Encryption at rest

Authentication encryption ???

Delete old data

Really delete it.
Lazy deleteiton
InnoDB data files
InnoDB redo logs
Deleted temp files

Binary logs expire_logs_days
Gootle MySQL data deleteion patch
Google encryptong patch - temp file
Deleted data frome

TOPIC

honey tokens are tokens that are never read
facebook account that nobody accesses
Finds trolling

First steps

SELinux AppArmro
Network isoaltion
two factor auth
verify database integrtity
Matintina tight access controls
Log everthting
Encrypt everything

passwords

No old_password=1
PAM+LDAP, SHA256 in MySQL 5.6

www.sqlhack.com passwd hacker

TOPIC

ASW_ENCRYPT AES DECRTYOS
slow log can show passwords

TOPIC

5.6, INSTALL PLUGIN validate_password SONAME 'validate_password.so'
earlier, pam plugiing

TOPIC

autossh - ssh tunnels

TOPIC

Rate limiting in rsyslogd
ssl encrutpiton cuts tps by half
Connection overhead goes through the roof
use connection pooling
Use ssh tunnel for lots of connect/disconet

TOPIC