1. ITN270.001 Wake Tech1 ITN270 Advanced Internet Databases Lecture 16. Security, Database Backups, Maintenance & Repair Topics: – Internal Security – External Security –Backups –Maintenance & Repair

2. ITN270.001 Wake Tech2 Internal Security Issues related to file access authorizations –Server Binary Files Only Administrator can access –Client programs Accessible to users so they can run the programs –Files created after the initial installation (option files, SSL-related files, database directory) Administrator

3. ITN270.001 Wake Tech3 Internal Security Access to files in data directory How to steal data –Six steps (Refer to your textbook) Securing Your MySQL Installation –Change owner for the following directory except the data directory #chown -R root.mysqlgrp /usr/local/mysql #chown -R mysqladm.mysqlgrp /usr/local/mysql/data

4. ITN270.001 Wake Tech4 Internal Security Change the mode of base directory & its subdirectory: –chmod 755 /usr/local/mysql mysqladm has full access and everyone else has only read and execute permission –chmod 755 /usr/local/mysql/bin –chmod 700 /usr/local/mysql/libexec clients do not have permission to access –change mode of data directory chmod -R go-rwx /usr/local/mysql/data –only account for running the server can directly access the data directory

5. ITN270.001 Wake Tech5 Internal Security Securing the Socket File –for connection by the client to the local host –change the mode so that users can only remove the files they created Securing Option files –should not be exposed

6. ITN270.001 Wake Tech6 External Security GRANT & REVOKE statements to set up & modify user access to MySQL Structure & Contents of Grant Tables:

7. ITN270.001 Wake Tech7 External Security Structure & Contents of Grant Tables: –user accounts for users may connect to the server password, global privileges - apply to all databases –db which accounts have privileges for which databases Privileges apply to all tables in a database –tables_priv table level privileges apply to all columns in a table –columns_priv column-level privilege

8. ITN270.001 Wake Tech8 Setting up MySQL accounts Without GRANT Statements Modify the grant tables directly Examples: –GRANT ALL ON *.* TO ‘userid’@’localhost’ IDENTIFIED BY ‘password’ WITH GRANT OPTION –INSERT INTO user VALUES(‘localhost’, ‘userid’, PASSWORD(‘password’), ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’);

9. ITN270.001 Wake Tech9 Setting Up Secure Connections Localhost –No need to have SSL in the connection Remote access: –GRANT ALL ON finance.* TO ‘userid’@’et219-1’ IDENTIFIED BY ‘password’ REQUIR SSL,

10. ITN270.001 Wake Tech10 Locking a database/table for read Lock a Table –LOCK TABLE tb_name READ RELEASE TABLE LOCK –UNLOCK TABLE; Locking All Database for READ access –FLUSH TABLES WITH READ LOCK RELEASE the LOCK –UNLOCK TABLES;

11. ITN270.001 Wake Tech11 Database Backups %mysqlsump *.* > filename direct copy –cp /usr/local/mysql/data/? Filename

12. ITN270.001 Wake Tech12 Table Repair and Data Recovery Checking & Reparing Database Tables –Checking - myisamchk myisamchk tbl_name myisamchk --check tbl_name –Reparing - myisamchk myisamchk --recover --quick tbl_name myisamchk --recover tbl_name myisamchk --safe-recover tble_name

13. ITN270.001 Wake Tech13 Table Repair and Data Recovery Checking & Reparing Tables Using the Server –CHECK mysqlcheck db_name; mysqlcheck db_name tb_name1, tb_name2 mysqlcheck --database db_name1 db_name2 mysqlcheck --all-databases –REPAIR mysqlcheck --repair ?? mysqlcheck --repair --quick ?? Mysqlcheck --repair --extended ??

14. ITN270.001 Wake Tech14 Table Repair and Data Recovery Recovering an entire database –Logfiles