About Securich. Started April Open Sourced June 2009 v0.1.1 Current version v0.2.5 GPLv2 (Sharing is Caring) Supported on MySQL 5.1.

Transcription

1

2 About Securich Started April 2009 Migration from Sybase to MySQL inspired it Open Sourced June 2009 v0.1.1 Current version v0.2.5 GPLv2 (Sharing is Caring) Supported on MySQL NDB cluster - untested

3 DBA responsibilities TO US DATA IS SACRED WE NEED TO PROTECT IT

4 User management How often do we audit user privileges and access levels? Do we forget to remove temporary privileges once the user is done with the task? How fast do we revoke access to former employees or compromised users?

5 MySQL security model Privileges checking hierarchy USER DB TABLES COLUMNS GRANTED - EXECUTE QUERY DENIED check db table GRANTED - EXECUTE QUERY DENIED check tables_priv table GRANTED - EXECUTE QUERY DENIED check columns_priv table GRANTED - EXECUTE QUERY DENIED - BLOCK

6 MySQL Security Model PROS Authentication against Password hashed by PASSWORD() function Wide range of privileges Intelligent control for requests of granting privileges (can t grant what user doesn t already have privileges on etc)

7 MySQL Security Model Quotes from High Performance MySQL 2 nd Ed "... MySQL doesn t provide any functionality for User groups or roles, as they re variously known in other database servers... " "... MySQL also doesn t provide any way for an administrator to enforce good password standards... "

8 MySQL Security Model Passwords limits not available No password size limit limitations No password history No password complexity meter No password minimum age Complex to manage No roles No user cloning Easily unsecured

9 MySQL Security Model Passwords limits made available Password size limit securich adds Password history Password complexity meter Password minimum age Easier to manage Pseudo roles provided Users can be cloned MySQL is secured on installation

10 - Roles What is a role? A role is a set or group of privileges that can be granted to users.

11 - Cloning

12 SECURI securich mysql grant / revoke create / drop information schema set password reconciliation

13 PROS Backend Open source Very easy to install, upgrade, manage and uninstall Doesn t remove any prior functionalities Enables migration from mysql to securich Enables roles Enhances password security Enables user cloning Enables granting privileges on tables using regexp Enables revoking privileges on tables using regexp

14 PROS Lightweight Doesn t require special resources Self explanatory design Compatible with MySQL onwards Friendlier display of `show grants` Embedded `help` - documentation Dynamic roles Enables temporary block and unblock user Stores user creation date and time

15 PROS Password dictionary compare Password complexity Configurable Audits changes in roles Audits password changes Audits grants and revokes Restricts password changes to current user Steady updates / new features Assumes no_auto_create Users can check their own privileges

16 PROS Users can be safely renamed Outputs suggestions if error is encountered Option to kill user connections when revoking privileges Enables reserved usernames Doesn t permit grants to the mysql database It doesn t need Perl or other kind of compiler or interpreter GUI is open source and platform independent

17 - Cons Doesn t work on versions and earlier because of certain types of prepared statements, it uses the information_schema and new password hashing No column level privileges (future feature) No functions privileges (future feature) ing user about password expiry is in bash (not SQL) It is beta

18 - Passwords Password setting by user requires old password Password needs to be not less than eight characters (configurable) Password complexity is configurable through sec_config or sam-my: Password length Uppercase Lowercase Numbers Special Characters Dictionary check Username equivalent check Password complexity is only NOT obeyed when password is changed by root Password history stores last five passwords

19 Live Demo

20 - Design

21 - Credits TradingScreen Nicklas Westerlund and Lenz Grimmer Big guys Command line Applications / Web app MySQL DB vi / vim SQL Yog + Wine MySQL Workbench screen Text Wrangler MySQL Docs visor Mac VIM Google (chrome / code) unix tools / bash XAMPP

22 THANK

23 - Thank You Darren Cassar Skype: darren.cassar URL: URL: URL: Blog:

24

25

26

27

28