Hardening Database Security Configuration

Apply production-grade security defaults to mitigate common attack vectors.

In this lesson, you will learn how to apply production-grade security defaults to your MySQL or MariaDB instance to mitigate common attack vectors and minimize your surface area.

When deploying a database, the default installation often prioritizes ease of use over security. To harden your environment, you must actively disable unnecessary features and enforce strict access controls. Think of your database as a fortress: you wouldn’t leave the back doors open or allow strangers to roam the halls.

The "Must-Do" Hardening Checklist

The most effective way to harden your configuration is to run the built-in mysql_secure_installation script, but as a professional, you should understand the manual configurations it enforces:

Remove Anonymous Users: By default, test installations often allow local users to connect without a password. You must remove these accounts to prevent unauthorized access.
```
DELETE FROM mysql.user WHERE User='';
FLUSH PRIVILEGES;
```
Disable Remote Root Login: The root user should only be allowed to connect from localhost. This prevents brute-force attacks against your most privileged account from over the network.
```
UPDATE mysql.user SET Host='localhost' WHERE User='root' AND Host='%';
```
Drop the Test Database: The test database is accessible to anyone and is a common target for privilege escalation or reconnaissance. Delete it immediately.
```
DROP DATABASE IF EXISTS test;
```

Minimizing the Surface Area

Beyond these basics, ensure your my.cnf or my.ini file is configured to restrict host-based access. Always bind your database to the specific internal IP of your server rather than 0.0.0.0 (all interfaces) to prevent exposure to the public internet.

Furthermore, ensure that Plugin Management is restricted. Only load plugins that are strictly necessary for your application’s operations to prevent malicious code injection or unauthorized feature usage. By strictly controlling who can connect and what the engine is permitted to execute, you effectively neutralize the vast majority of automated exploit attempts aimed at database infrastructure.

Key Takeaway: Hardening is about reducing your attack surface by deleting anonymous accounts, restricting privileged access to the local machine, and removing unnecessary databases.