Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Recently, one of my centos linux servers was hacked and the cause of due to phpMyAdmin. It was said due to this problem PhpMyAdmin vulnerability CVE-2011-2505 (http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2505). What is the best way to login securely into my mysql db? Any idea please.

share|improve this question
    
You can connect with MySQL Workbench (via SSH tunnel). –  ypercube Apr 26 '12 at 5:55
    
@ypercube but then again I must open port 3306 which will become another threat to me thereafter right? –  newbie14 Apr 28 '12 at 16:46
    
No, you only open ssh port (all other communication passes through that, that's why it's called "tunneling"). –  ypercube Apr 28 '12 at 16:55
    
@ypercube ok first I must install the mysql workbench on that particular pc right? Then how to connect cause I saw the website show is port 3306 can you explain further on this? –  newbie14 Apr 28 '12 at 17:00
    
You actually don't even need Workbench. Here's a quick intoduction: MySQL ssh tunnel With this, (while the tunnel is working) all applications in your local machine will think that there's a MySQL server, locally at 3307. So, you can connect with either Command Line Interface or Workbench or whatever. –  ypercube Apr 28 '12 at 17:04
show 2 more comments

2 Answers

You need to make sure your mysql authentication scheme has been cleaned up

MySQL 5.0 Certification Study Guide says on Page 498 Paragraph 6 in its bulletpoints brings out how to cleanup the authentication process:

On Unix, MySQL comes with a mysql_secure_installation script that can perform several helpful security-related operations on your installation. The script has the following capabilities:

  • Set a password for the root accounts
  • Remove any remotely accessible root accounts.
  • Remove the anonymous user accounts. This improves security because it prevents the possibility of anyone connecting to the MySQL server as root from a remote host. The results is that anyone who wants to connect as root must first be able to log in on the server host, which provides an additional barrier against attack.
  • Remove the test database (If you remove the anonymous accounts, you might also want to remove the test database to which they have access).

A remotely accessible account is an account whose host is % which allows anyone and his grandmother. To find those accounts, run this query:

SELECT user,host FROM mysql.user WHERE host='%';

You should also be cognizant of how MySQL user authentication occurs.

According to MySQL 5.0 Certification Study Guide pages 486,487, the following describes mysql's authentication algorithm:

There are two stages of client access control:

In the first stage, a client attempts to connect and the server either accepts or rejects the connection. For the attempt to succeed, some entry in the user table must match the host from which the client connects, the username, and the password.

In the second stage (which occurs only if a client has already connected successfully), the server checks every query it receives from the client to see whether the client has sufficient privileges to execute it.

The server matches a client against entries in the grant tables based on the host from which the client connects and the user the client provides. However, it's possible for more than one record to match:

Host values in grant tables may be specified as patterns contains wildcard values. If a grant table contains entris from myhost.example.com, %.example.com, %.com, and %, all of them match a client who connects from myhost.example.com.

Patterns are not allowed for the User values in grant table entries, but a username may be given as an empty string to specify an anonymous user. The empty string matches any username and thus effectively acts as a wildcard.

When the Host and the User values in more than one user table record match a client, the server must decide which one to use. It does this by sorting records with the most specific Host and User column values first, and choosing the matching record that occurs first in the sorted list, Sorting take place as follows:

In the Host Column, literal values such as localhost, 127.0.0.1, and myhost.example.com sort ahead of values such as %.example.com that have pattern characters in them. Pattern values are sorted according to how specific they are. For example, %.example.com is more specific than %.com, which is more specific than %.

In the User column, non-blank usernames sort ahead of blank usernames. That is, non-anonymous users sort ahead of anonymous users.

The server performs this sorting when it starts. It reads the grant tables into memory, sorts them, and uses the in-memory copies for access control.

SUMMARY

If you have any users that must have remote access, change the host of each user that has % into the public IP you will be connecting from.

For example, if the user myuser must connect from 208.21.42.184, replace the host like this

UPDATE mysql.user SET host='208.21.42.184' WHERE user='myuser' AND host='%';
FLUSH PRIVILEGES;

You should also be checking for the presence of any test databases. The presence of test databases. Any database named test or whose first five(5) characters are test_ need to be renamed immediately !!! I wrote an earlier post on how and why.

share|improve this answer
    
I tried SELECT user,host FROM mysql.user WHERE host='%'; and it gave me empty set so I guess this level I am save right. Secondly now normally I access the phpMyAdmin and here is where I have been compromised. Any help based on your experience? –  newbie14 Apr 27 '12 at 16:22
    
what else should I be checking? –  newbie14 Apr 28 '12 at 16:44
add comment

Use a VPN connection to connect to the network which is hosting the database server.

A database server should never be directly accessible from the public Internet. If it is directly accessible it will be broken in to. It's just a mater of time.

share|improve this answer
    
@denny what should I do now? How do you advice me to do it? Setup vpn is it? So internally from server can I call it ? –  newbie14 Apr 26 '12 at 7:43
    
When you setup a VPN server at the data center you then VPN into the network via that VPN server (some routers can do this as well). At that point you are on the Data Center network and can log into the MySQL server. I'm not a fan of pushing my book on here, but it's called Securing SQL Server (securingsqlserver.com) while it's aimed at Microsoft SQL Server a lot of the concepts apply to app database platforms, especially the 1st chapter on designing your network with security in mind. –  mrdenny Apr 26 '12 at 21:10
    
@denny the problem I am hosting all my server in data center. So one server is web server and the other db server. So are you saying first log into the webserver and then using that to login into my db server? –  newbie14 Apr 27 '12 at 16:18
    
You should setup a separate website on the web server for running admin type apps like PhpMyAdmin and make that website so that it's not accessible from the Public Internet. This way people can't find and access your admin functions via the public website. Having everything on a single site may be convenient, but it it's convenient it probably isn't secure. –  mrdenny Apr 27 '12 at 20:15
    
@denny, Say I got server A(I put now the phpMyAdmin here) then it with locally link to Server B which is my db am I right here? Is this how it suppose to be but if the compromise my server A phpMyAdmin also going to be a problem then right? When you said separate means how you suggest to be done? Thank you. –  newbie14 Apr 28 '12 at 7:23
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.