If you are using Percona XtraBackup with
to create encrypted backups, and are using versions older than 2.3.6 or 2.4.5, we advise that you upgrade Percona XtraBackup.
Note: this does not affect encryption …[Read more]
The MariaDB audit plugin is an audit plugin that is bundled with MariaDB server. However, even though it is bundled with MariaDB, the plugin is actually compatible with MySQL as well. In this blog post, I will describe how to install the plugin with MySQL. Install the plugin Unfortunately, neither MariaDB Corporation nor MariaDB Foundation currently distribute a standalone binary ... Read More
Using Vault with MySQL
In my previous post I discussed using GPG to secure your database credentials. This relies on a local copy of your MySQL client config, but what if you want to keep the credentials stored safely along with other super secret information? Sure, GPG could still be used, but there must be an easier way to do this.
This post will look at a way to use Vault to store your credentials in a central location and use them to access your database. For those of you that have not yet come across Vault, it is a great way to manage your secrets – securing, storing and tightly controlling access. It has the added benefits of being able to handle leasing, key revocation, key rolling and auditing.
During this blog post we’ll accomplish the following …[Read more]
It’s been a busy month for file vulnerabilities. Thanks to Dawid Golunski at legalhackers.com for giving us all the opportunity to tighten security in our MySQL, MariaDB, and Percona Server instances.
Details were released for the CVE 6663 mentioned last week and for a new CVE 6664:
Note that 6664 is dependent on 6663, and 6663 can be mitigated by turning off symbolic_links (=0). Upgrade to the latest versions also fixes the problem. Regardless, the attacker …[Read more]
It is a common auditing requirement to log user connection
events, including whether or not authentication was
There are a number of alternatives available for MySQL, but unfortunately there is no built-in functionality at the time of this writing. In this post we will discuss auditing MySQL users with McAfee plugin, which is available under GPL Version 2 license.
These apply to debian-based hosts, but instructions for red hat are similar.
1. Download latest plugin release from github.
At the time of this post for MySQL 5.5 you can get:
2. Decompress …[Read more]
At our September 2016 New York City MySQL Meetup was a demonstration of how to implement role-based security in MySQL using Hexatier. In addition, several other important security features demonstrated included role based dynamic data masking down to a per column level and full statement auditing.
Thanks to Scott Unrick, Lead Database Administrator at Teladoc for the great presentation. Slides are available here.[Read more]
Percona XtraDB Cluster 5.6.30-25.16.2 is now the current release, based on the following:
This release provides a …[Read more]
How it is supposed to be used
I’ll also list which MySQL versions include the vulnerability fixes.
The website legalhackers.com contains the full, current explanation of the …[Read more]
Since MySQL 5.6.6, it became possible to store MySQL credentials in an encrypted login path file named .mylogin.cnf, using the mysql_config_editor tool. This is better than in plain text anyway.
What if I need to read this password in plain text?
Perhaps because I didn’t save it? It might be that I don’t need it for long (as I can reset it), but it’s important that I get it.
Unfortunately (or intentionally),
doesn’t allow it.
[root@db01 ~]# cat /root/.mylogin.cnf ????uUd????ٞN??3k??ǘ);??Ѻ0 ?'?(??W.???Xܽ<'?C???ha?$ ?? …[Read more]