MySQL, the world’s most popular open source database and the second most widely used open-source relational database management system (RDBMS), is a crucial component of many web applications. However, its default installation is not securely configured. For the sake of security, it’s essential to manually run the mysql_secure_installation wizard to perform basic MySQL hardening.<\/p>\n
This guide will walk you through the steps to secure your MySQL server, specifically focusing on MySQL Community Server 5.5.39 running on CentOS 6.5 and CentOS 6.6.<\/p>\n
Before we dive into the tutorial, it’s worth noting that securing your MySQL server is a critical step in setting up a secure web environment. Whether you’re using a dedicated<\/a>, a VPS<\/a>, or cloud<\/a> hosting, ensuring the security of your MySQL server is paramount.<\/p>\n The first step in securing your MySQL server is to run the mysql_secure_installation wizard. This script is recommended for all MySQL servers in production use. It will guide you through several steps to secure your MySQL installation.<\/p>\n The script will first ask for the current password for the root user. If you’ve just installed MySQL and haven’t set the root password yet, the password will be blank, so you should just press enter.<\/p>\n The script will then guide you through several steps, including setting the root password, removing anonymous users, disallowing root login remotely, removing the test database and access to it, and reloading the privilege tables.<\/p>\n System response:<\/p>\n The next step is to set the \u201cbind-address\u201d parameter within the \u201c[mysqld]\u201d section in \/etc\/my.cnf. Configure this to your VPS local loopback network device, which is \u201c127.0.0.1\u201d. Please make sure that you only perform this step if you confirm no other server will need to access the database on your VPS.<\/p>\n After setting the \u201cbind-address\u201d parameter, you need to restart your MySQL server for the changes to take effect.<\/p>\n Finally, verify that the MySQL port is listening to 127.0.0.1 only.<\/p>\n By following these steps, you can ensure that your MySQL server is secure. Whether you’re running a LiteSpeed<\/a>, Apache<\/a>, or Nginx<\/a> server, securing your MySQL installation is a critical step in maintaining a secure web environment.<\/p>\n Securing your MySQL server is a crucial step in maintaining a secure web environment. By following the steps outlined in this guide, you can ensure that your MySQL installation is secure, regardless of whether you’re using a dedicated<\/a>, a VPS<\/a>, or cloud<\/a> hosting.<\/p>\n Remember, securing your MySQL server is not a one-time task, but an ongoing responsibility. Regularly reviewing and updating your security settings, as well as staying informed about the latest security best practices and potential vulnerabilities, will help keep your MySQL server, and by extension your web applications, safe and secure.<\/p>\n Whether you’re a seasoned webmaster or a beginner, this guide provides a comprehensive and easy-to-follow approach to securing your MySQL server. By following these steps, you can contribute to the overall security of your web environment and ensure the integrity and confidentiality of your data.<\/p>\n What is the purpose of the mysql_secure_installation command?<\/p>\n \n The mysql_secure_installation command is a script that performs several security-related operations on your MySQL installation. It helps you secure your MySQL server by setting a password for the root accounts, removing root accounts that are accessible from outside the localhost, removing anonymous-user accounts, and removing the test database.<\/span>\n <\/p>\n<\/li>\n Why do I need to set the \u201cbind-address\u201d parameter?<\/p>\n \n Setting the \u201cbind-address\u201d parameter to \u201c127.0.0.1\u201d ensures that your MySQL server only accepts connections from clients running on the same machine, i.e., localhost. This is a security measure to prevent remote connections to your MySQL server.<\/span>\n <\/p>\n<\/li>\n Why is it necessary to restart the MySQL server after changing the configuration?<\/p>\n \n Restarting the MySQL server allows any changes you’ve made to the configuration file to take effect. If you don’t restart the server, it will continue to use the old configuration until the next restart.<\/span>\n <\/p>\n<\/li>\n What does the netstat command do?<\/p>\n \n The netstat command is used to display network connections, routing tables, interface statistics, and more. In this context, it’s used to verify that the MySQL port is listening to 127.0.0.1 only.<\/span>\n <\/p>\n<\/li>\n What are the security risks of not securing a MySQL server?<\/p>\n \n If a MySQL server is not secured, it can be vulnerable to a variety of attacks. These include unauthorized access to the database, data theft, data corruption, and even denial-of-service (DoS) attacks. By not securing your MySQL server, you risk exposing sensitive data and potentially disrupting your web services.<\/span>\n <\/p>\n<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":" MySQL, the world’s most popular open source database and the second most widely used open-source relational database management system (RDBMS), is a crucial component of many web applications. However, its…<\/p>\n","protected":false},"author":6,"featured_media":5283,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":0,"footnotes":""},"categories":[2055,1008],"tags":[1256,1536,1585],"class_list":["post-5280","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-centos","category-mysql","tag-centos-6-5","tag-linux","tag-mysql"],"_links":{"self":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts\/5280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/comments?post=5280"}],"version-history":[{"count":0,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts\/5280\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/media\/5283"}],"wp:attachment":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/media?parent=5280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/categories?post=5280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/tags?post=5280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Step 1: Run mysql_secure_installation Wizard<\/h2>\n
\r\n[root@vps ]# mysql_secure_installation\r\n<\/pre>\n
\r\n[root@vps ]# mysql_secure_installation\r\n\r\n\r\n\r\n\r\nNOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL\r\n SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!\r\n\r\n\r\nIn order to log into MySQL to secure it, we'll need the current\r\npassword for the root user. If you've just installed MySQL, and\r\nyou haven't set the root password yet, the password will be blank,\r\nso you should just press enter here.\r\n\r\nEnter current password for root (enter for none):\r\nOK, successfully used password, moving on...\r\n\r\nSetting the root password ensures that nobody can log into the MySQL\r\nroot user without the proper authorisation.\r\n\r\nSet root password? [Y\/n] y\r\nNew password:\r\nRe-enter new password:\r\nPassword updated successfully!\r\nReloading privilege tables..\r\n ... Success!\r\n\r\n\r\nBy default, a MySQL installation has an anonymous user, allowing anyone\r\nto log into MySQL without having to have a user account created for\r\nthem. This is intended only for testing, and to make the installation\r\ngo a bit smoother. You should remove them before moving into a\r\nproduction environment.\r\n\r\nRemove anonymous users? [Y\/n] y\r\n ... Success!\r\n\r\nNormally, root should only be allowed to connect from 'localhost'. This\r\nensures that someone cannot guess at the root password from the network.\r\n\r\nDisallow root login remotely? [Y\/n] y\r\n ... Success!\r\n\r\nBy default, MySQL comes with a database named 'test' that anyone can\r\naccess. This is also intended only for testing, and should be removed\r\nbefore moving into a production environment.\r\n\r\nRemove test database and access to it? [Y\/n] y\r\n - Dropping test database...\r\n ... Success!\r\n - Removing privileges on test database...\r\n ... Success!\r\n\r\nReloading the privilege tables will ensure that all changes made so far\r\nwill take effect immediately.\r\n\r\nReload privilege tables now? [Y\/n] y\r\n ... Success!\r\n\r\nCleaning up...\r\n\r\n\r\n\r\nAll done! If you've completed all of the above steps, your MySQL\r\ninstallation should now be secure.\r\n\r\nThanks for using MySQL!\r\n<\/pre>\n
Step 2: Set \u201cbind-address\u201d Parameter<\/h2>\n
\r\n[root@vps ~]# vi \/etc\/my.cnf\r\n[mysqld]\r\n..\r\nbind-address = 127.0.0.1\r\n..\r\n<\/pre>\n
Step 3: Restart Your MySQL Server<\/h2>\n
\r\n[root@vps ~]# service mysqld restart\r\n<\/pre>\n
Step 4: Verify the MySQL Port<\/h2>\n
\r\n[root@vps ~]# netstat -plunt | grep 3306\r\ntcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 8224\/mysqld\r\n<\/pre>\n
Commands Mentioned<\/h2>\n
\n
Conclusion<\/h2>\n
FAQ<\/h2>\n
\n