Securing MySQL Server

Security in MySQL goes far beyond setting passwords. It involves configuring access controls, enforcing encryption, managing user roles, and following best practices to protect data from unauthorized access, breaches, and misuse.

Run the Secure Installation Wizard

MySQL provides a built-in script to harden your server configuration. This is the first and most essential step after installation. It closes common security gaps and enforces basic hygiene.

Command:

sudo mysql_secure_installation

What it does:

• Sets a strong root password
• Removes anonymous users
• Disables remote root login
• Removes test databases
• Reloads privilege tables

Disable Remote Root Login

Restrict root access to local connections only. Remote root access is a major security risk. Ensure root is defined as 'root'@'localhost' and not 'root'@'%'.

Command:

UPDATE mysql.user SET Host='localhost' WHERE User='root';
FLUSH PRIVILEGES;

Limit Host Access

Avoid using '%' in user definitions unless absolutely necessary. This wildcard
allows access from any host, which increases exposure. Instead, use localhost,
specific IPs, or domain names to restrict access scope.

Example:

CREATE USER 'admin'@'localhost' IDENTIFIED BY 'securepass';

Use Strong Passwords

Weak passwords are one of the most common attack vectors. Use complex, randomly generated passwords with a mix of characters. Enforce minimum length and complexity, rotate passwords regularly, and consider using password managers.

Example:

ALTER USER 'admin'@'localhost' IDENTIFIED BY 'Xy9@#kL!2z';

Use SSL/TLS for Encrypted Connections

Encrypt client-server communication to prevent data interception and man-in-the-middle attacks. Generate or obtain SSL certificates, configure MySQL (my.cnf), and require SSL
for users.

Command:

CREATE USER 'secure_user'@'%' REQUIRE SSL;

Verification:

SHOW STATUS LIKE 'Ssl_cipher';