Re: Enhancement Suggestion for Security. - Peter Zaitsev - com.mysql.lists.bugs

4 messages in com.mysql.lists.bugsRe: Enhancement Suggestion for Security.

From	Sent On	Attachments
Prashant	04 Mar 2003 22:35
Peter Zaitsev	04 Mar 2003 23:20
Prashant	05 Mar 2003 04:51
Peter Zaitsev	19 Mar 2003 11:31

Subject:	Re: Enhancement Suggestion for Security.
From:	Peter Zaitsev (pet...@mysql.com)
Date:	03/04/2003 11:20:44 PM
List:	com.mysql.lists.bugs

On Wed, 2003-03-05 at 09:36, Prashant wrote:

Hello,

I am Prashant Gupta from HP, working on the ServiceGuard (Clustering product of HP). We have come across a Security issue which working on a scripts for starting & stopping the MySQL Database.

This is NOT a Bug, but a possible enhancement request. But, it does give rise to security problem.

For starting & stopping the MySQL database, DB Admin user password is required (assuming password is set for admin user). MySQL tools asks for the password while trying to start/stop the database. But, providing Admin user password in ASCII form in any file (Scripts) will jeopardize security. Also, each time the Admin user changes its password, this scripts will have to be Updated.

Dear Parashat,

Actually root password is not needed for starting and stopping database. Please take a look how mysql.server included in distribution works for details.

In short I do not understand in which case you can get MySQL to ask password at startup. The trick with shutdown is - you shall send TERM signal to mysqld (pid file contains the pid) instead of using mysqladmin shutdown which is intended for unprivileged user usage and requires password to perform shutdown action.

Also, if password is provided through the command line then any commands like "ps -ef" will show the password to other users on the system. This is another security problem.

Have you seen MySQL displaying password in ps -ef ? The normal behaviour would be to display:

pz 1816 1238 0 10:15 pts/3 00:00:00 mysql -u root -px xxxxxx

As you might see password is not displayed.

Taking example of Oracle: We can login to the "oracle" user from the "root" login (using "su - oracle" ) & start/stop the database. That is to say that the "oracle" user is not again validated at the time of starting & stopping the database.

As I wrote before - you do not need to provide password to start/stop MySQL.

Currently we are using MySQL Version mentioned below on Linux 7.3 platform.

+-----------+ | version() | +-----------+ | 3.23.36 | +-----------+

This is very old MySQL version. We would really recommend you to upgrade to MySQL 3.23.55 which has a lot of issues fixed, including some security related.

In case you're just developing your product yet, using MySQL 4.0 is recommended as it will be likely released as stable in a few weeks.

Please let me know if you still have problems, also note bu...@lists.mysql.com is intended only for repeatable bug report. For such sort of messages mys...@lists.mysql.com shall be used instead.