About Securich Started April 2009 Migration from Sybase to MySQL - PowerPoint PPT Presentation

About Securich  Started April 2009  Migration from Sybase to MySQL inspired it  Open Sourced June 2009 v0.1.1  Current version v0.2.5  GPLv2 (Sharing is Caring)  Supported on MySQL 5.1.12 +  NDB cluster - untested

DBA responsibilities TO US DATA IS SACRED WE NEED TO PROTECT IT

User management  How often do we audit user privileges and access levels?  Do we forget to remove temporary privileges once the user is done with the task?  How fast do we revoke access to former employees or compromised users?

MySQL security model Privileges checking hierarchy USER • GRANTED - EXECUTE QUERY • DENIED check db table DB • GRANTED - EXECUTE QUERY • DENIED check tables_priv table TABLES • GRANTED - EXECUTE QUERY • DENIED check columns_priv table • GRANTED - EXECUTE QUERY COLUMNS • DENIED - BLOCK

MySQL Security Model PROS  Authentication against 'username'@'hostname'  Password hashed by PASSWORD() function  Wide range of privileges  Intelligent control for requests of granting privileges (can’t grant what user doesn’t already have privileges on etc)

MySQL Security Model  Quotes from “High Performance MySQL 2 nd Ed” " ..... MySQL doesn’t provide any functionality for User groups or roles , as they’re variously known in other database servers ..... " " ..... MySQL also doesn’t provide any way for an administrator to enforce good password standards ..... "

MySQL Security Model  Passwords limits not available • No password size limit • No password history limitations • No password complexity meter • No password minimum age  Complex to manage  No roles  No user cloning  Easily unsecured

MySQL Security Model  Passwords limits made available • Password size limit securich adds • Password history • Password complexity meter • Password minimum age  Easier to manage  Pseudo roles provided  Users can be cloned  MySQL is secured on installation

SECURI - Roles  What is a role ?  A role is a set or group of privileges that can be granted to users.

SECURI - Cloning

SECURI securich mysql information schema create / grant / set password reconciliation revoke drop

SECURI  PROS • Backend Open source • Very easy to install, upgrade, manage and uninstall • Doesn’t remove any prior functionalities • Enables migration from mysql to securich • Enables roles • Enhances password security • Enables user cloning • Enables granting privileges on tables using regexp • Enables revoking privileges on tables using regexp

SECURI  PROS • Lightweight – Doesn’t require special resources • Self explanatory design • Compatible with MySQL 5.1.12 onwards • Friendlier display of `show grants` • Embedded `help` - documentation • Dynamic roles • Enables temporary block and unblock user • Stores user creation date and time

SECURI  PROS • Password dictionary compare • Password complexity – Configurable • Audits changes in roles • Audits password changes • Audits grants and revokes • Restricts password changes to current user • Steady updates / new features • Assumes no_auto_create • Users can check their own privileges

SECURI  PROS • Users can be safely renamed • Outputs suggestions if error is encountered • Option to kill user connections when revoking privileges • Enables reserved usernames • Doesn’t permit grants to the ‘mysql’ database • It doesn’t need Perl or other kind of compiler or interpreter • GUI is open source and platform independent

SECURI - Cons • Doesn’t work on versions 5.1.11 and earlier because of certain types of prepared statements, it uses the information_schema and new password hashing • No column level privileges (future feature) • No functions privileges (future feature) • Emailing user about password expiry is in bash (not SQL) • It is beta

SECURI - Passwords  Password setting by user requires old password  Password needs to be not less than eight characters (configurable)  Password complexity is configurable through sec_config or sam-my: Password length Special Characters Uppercase Dictionary check Lowercase Username equivalent check Numbers  Password complexity is only NOT obeyed when password is changed by root  Password history stores last five passwords

SECURI Live Demo

SECURI - Design

SECURI - Credits TradingScreen Nicklas Westerlund and Lenz Grimmer Big guys Command line Applications / Web app MySQL DB vi / vim SQL Yog + Wine MySQL Workbench screen Text Wrangler MySQL Docs visor Mac VIM Google (chrome / code) unix tools / bash XAMPP

SECURI THANK

SECURI - Thank You Darren Cassar Skype: darren.cassar Email: darren@darrencassar.com Email: info@securich.com URL: http://www.securich.com URL: http://code.google.com/p/securich URL: http://code.google.com/p/sam-my Blog: http://www.mysqlpreacher.com

SECURI

SECURI

SECURI

SECURI

SECURI