© Provided by MUO

Beginner penetration testers, in particular, place less emphasis on database security in general. An application without a database configuration and security tests can't be secure. You might already be using MySQL software, a database management system, so how can you make it more secure? Here are seven steps you need to follow.

1. Use SSH Tunneling Instead of Remote Connection

The MySQL service runs on port 3306 by default. When you install MySQL, you will see that port 3306 is in listening mode for all connections. As it stands, the MySQL port is open to the outside world. That's why you should set the MySQL service to listen only to the local address.

Since servers are usually run on a Linux distribution, the examples below are based on a Debian distribution. The file you need to use for SSH tunneling instead of remote connection and to close the default port to the outside world is /etc/mysql/my.cnf. In this file, you need to open a field called [mysqld] and write the following command:

[mysqld]

bind-address=127.0.0.1

After this process, don't forget to save this file and restart the service with the following command:

sudo systemctl restart mysqld

# or

sudo systemctl restart mariadb.service

With this, the MySQL service will only listen to the local address.

If you are using MariaDB, you can also examine /etc/mysql/mariadb.conf.d/50-server.cnf and check if there is a definition for bind-address.

Now that you have the bind-address set to 127.0.0.1, which is localhost, you can run a Nmap scan and check the output:

You can see the MySQL port as 127.0.0.1 represents the localhost you see. You can try and change the bind address again to make sure this works:

[mysqld]

bind-address=127.5.5.1

Then save the /etc/mysql/my.cnf file and restart MySQL service. If you carry out a Nmap scan again at this stage, you should not see this bind address on localhost.

Once you know this works, go back to the settings from the first step and set the bind address back to 127.0.0.1 and save again.

2. Set Up a Local File Access Barrier

MySQL can communicate with the local file system. With queries, you can see the content of a text in the local file system or burn the query result to a disk. To prevent malicious attackers using this feature, you must prevent MySQL from communicating with the local file system.

You can use a function called local-infile to take precautions. For example, imagine that you have a file named "/etc/secretfile.txt" and you have a password in this file. If the value of the local-infile function in your /etc/mysql/my.cnf file is 1, then the access is open. So you can access the secretfile.txt file.

The value of the local-infile function is 1. Restart the MySQL database for the changes to take place. Now, connect to MySQL with the following command and check whether you can see the secretfile.txt file:

It's not difficult to capture the information in any file on your computer.

To solve this problem, change the local-infile value in your /etc/mysql/my.cnf file as follows:

[mysqld]

local-infile=0

Restart the MySQL service. Reconnect to MySQL and repeat the previous step; you should no longer be able to see the file contents.

If users do not already have read and write permissions on local files, they will not be able to see this file. However, it is still something you should check in penetration tests and database security.

3. Set Application Users and Passwords

The database management user and the MySQL user accessing the database must be different from each other. In other words, connecting applications to MySQL with root users is extremely dangerous. If possible, define the users of applications that do not perform UPDATE or INSERT operations separately.

Another thing to consider at this point is user passwords. As in almost every field, passwords for MySQL users need to be complex and unpredictable. If you need help with this, there are great password generator systems you can use.

4. Delete Anonymous Users

When you install MySQL by default, some anonymous users occur. You need to delete these and block their access. For a secure MySQL server, you should not get any response as a result of the following query:

SELECT * FROM mysql.user WHERE USER="";

# Example Output

Empty set (0.001 sec)

If there are any results, you should delete these anonymous users. For example, if there were an anonymous account named "anonuser" in an environment named "localhost", you would have to use a command like the following to delete this account:

5. Check MySQL Local File Permissions

Imagine you are a database administrator and you want to return to data from a week ago. In this case, you might have to connect to the database server via SSH and change the MySQL files you want. While doing this, you might have used the root user privileges of Linux; that is, the ownership and permissions of the data files can change. You don't want that.

Look at the /var/lib/mysql directory to check the permissions granted. What you need to check here is whether the owner of all files is the MySQL user. The following command will do the trick:

The read and write permissions of the files should only be for the MySQL user. No other users should have any permissions.

6. Use MySQL SSL

Thinking about a concrete example is the best way to understand MySQL and SSL usage. Imagine that one of the servers in the ABC region, where there are many different servers, is taken over by malicious hackers. Hackers will carry out an internal scan in the ABC region. In this way, they collect information about the servers.

If they detect a MySQL server during this process, they can perform a Man-in-the-Middle (MitM) attack on the target server, meaning they can steal the session information of applications and users connecting to this server. One of the best ways to avoid this is to enable SSL on the MySQL server.

7. Log and History Files

You use MySQL logs to analyze and find errors. You can edit where these logs are kept by entering my.cnf as follows:

# /etc/mysql/my.cnf

[mysqld]

log =/var/log/mylogfiles

You can change the mylogfiles name or location as you wish. There is one more file you need to check. When you connect to the MySQL server in a Linux terminal and type various commands, these queries are saved in the mysql_history file. If you run the following command, you can see the queries you are using in the MySQL terminal:

You need to delete the contents of this file if you don't want to provide information about what kind of queries you are making inside the server. Use the following command to delete the contents of the file:

You can then check the file contents again.

Whoever Owns the Database Owns the System

No matter what industry you work in, your database always contains important information. This can be your customers, bank accounts, and passwords. Malicious attackers know the importance and value of these. Database developers and administrators need to at least know the basics that they will encounter in penetration tests in order to beat the hackers.

Saint Louis University’s nationally-ranked Master of Health Administration (MHA) program is celebrating its 75th year, making it one of the oldest MHA programs in the country and a pioneer in health management education. 

Saint Louis University Master of Health Administration Celebrates 75 Years

Health care is a rapidly growing industry in need of highly competent managers with diverse backgrounds and experiences. If you’re interested in pursuing a career in health administration, SLU's College for Public Health and Social Justice is an ideal place to start for both undergraduate and graduate students.

As a student in one of SLU’s health administration programs, you’ll experience:

• Flexible graduate degree options that include in person, hybrid (online and in-person) and online only classes, so you can select the program that best fits your schedule.
• One-on-one attention from faculty that goes beyond the classroom to prepare students for fellowships and career advancement.
• Access to industry experts who bring applied health care projects into the classroom.
• Integrated classroom experiences with students from public health, social work, law, business, medicine, and allied health.

Explore Your Options

We offer undergraduate, master's and dual degree programs in health administration:

Gain Valuable Experience

Health administration is a complex discipline that requires comprehensive management skills in operations, human resources, finance, quality improvement, population health management, and health policy.

SLU's programs offer you a practice-integrated education. Our students are transformed into knowledgeable, ethical professionals prepared for a range of careers across the health sector. As a student in our programs, you'll have access to robust professional development resources that include one-on-one coaching, lectures and workshops from industry experts, and other select training opportunities.

A Leader in the Field

A standout amongst its peers, SLU’s M.H.A. program is one of the nation’s oldest and largest graduate programs in health administration. It is consistently ranked among the top programs in graduate health care management education by US News and World Report, accredited by the Commission on the Accreditation of Healthcare Management Education (CAHME), and highly regarded by its competitors. SLU’s program was recently awarded Program of the Year by the Association of University Programs in Health Administration (AUPHA). SLU’s program also has one of the largest and most engaged alumni networks in the field.

Dec. 7—DANVILLE — After the unexpected resignation of longtime Vermilion County Health Department Director/Administrator Doug Toole last month, the Board of Health had to act quickly.

In a special meeting on Tuesday, the board selected the department's director of environmental health, Jana Messmore, as interim director/administrator.

Messmore had been in an interim position since Toole resigned on Nov. 16. But Tuesday's meeting made it official.

"It's been a little bit hectic, but we have a great staff at the health department and they have done their part in asking what they can do to help," Messmore said. "I am just navigating to get through until they find someone to hire."

No official reason has been given for Toole's departure and the Commercial-News has been unable to reach him for comment. Toole's position as leader of the health department became higher profile during the COVID-19 pandemic when public health issues were magnified.

Messmore has been part of the department for 16 years and during that time she said she has built relationships that are going to help her through this period.

"I started in 2006 as an inspector and moved up to food program supervisor and I started running environmental health this past summer," Messmore said. "Every day has been easier and people from other local health departments have been contacting me and everyone is ready to step up and answer any questions that I have."

Also on Nov. 16, new Board President Brad Gross said starting his term as leader of the board with a search for a new department director was challenging.

"I can't go into personnel, but it comes with the job," Gross said. "People come and people go. We are lucky that Jana is here and she's great and I have all the confidence in her. The health department is lucky to have her."

Applications are coming in for a permanent director, Gross said. Messmore — who is still running the environmental health division — said her name will not be in the mix.

Story continues

"I have two small children and I could not dedicate all the time that this position would require," Messmore said. "Maybe in the future, but I really love environmental health and I am not done with that job yet."

Gross said the process has started and it will not end until the board finds the perfect candidate.

"We are already getting applications and we are going to start the process," Gross said. "We are going to look at one application at a time and go from there. It's a process."

Ranked #13 nationwide among graduate programs for health care management by U.S. News & World Report, Saint Louis University's Master of Health Administration is your conduit to a successful career.

A Master of Health Administration (M.H.A.) is the MBA of the health care world. Graduates from the nationally-ranked SLU M.H.A. program lead careers in a variety of health care organizations such as hospitals, health systems, insurance companies, pharmacy benefit management organizations, consulting firms, and physician practices.

Applications Open

Why Choose SLU For Your M.H.A.?

• SLU's nationally-ranked program offers you a practice-integrated education. Our students are transformed into knowledgeable, ethical professionals prepared for a range of management careers across the health sector.
• As one of the nation's most established and largest M.H.A. programs, we'll keep you connected to a vast alumni network.
• At SLU, we deploy a nationally recognized competency model that has been adopted and adapted by health management and health administration programs throughout the country and were recently awarded Program of the Year by the Association of University Programs in Health Administration (AUPHA).

Our accurate alumni have been placed in organizations such as:

Executive M.H.A. (Online)

The Executive M.H.A. program is uniquely designed for working professionals with courses 90% online and three yearly in-person executive weekends. Our cohorts include students with backgrounds varying from surgeons, doctors, nurses, pharmaceutical and medical equipment sales, to consulting, accounting, marketing, and communications. The students live locally and across the U.S. and a GRE is not required. Our executive M.H.A. graduates advance in their current health care careers or use their education to transition into the health care industry.

Apply Through SLU Graduate Admission  Apply Through HAMPCAS.org

Full-Time M.H.A.

The full-time M.H.A. program is designed for students looking for a traditional education experience. In person students live locally or on campus and attend classes throughout the day. A GRE is not required and  students have access to unique case competitions, internships, and fellowship opportunities. SLU's full-time M.H.A. graduates move forward into successful positions with leading health care organizations.

Apply Via SOPHAS.org  Apply Via HAMPCAS.org

Master's of Health Care Management (Online)

SLU's Master's of Health Care Management (MHCM) program prepares individuals to develop, plan, and manage health care operations and services within health care facilities and across health care systems. Students have the option to pursue specialized certificates in performance excellence, health data analytics, public health, and other high demand areas in health care. Each course includes instructor-designed opportunities for synchronous interaction tailored for the specific course. 

The 41-credit hour online Master of Health Care Management (MHCM) Program offers the benefits of flexible, asynchronous learning and a short time to degree completion for busy professionals or accurate college graduates with little or no professional experience.

Apply Via SOPHAS.org Apply Via HAMPCAS.org

Questions? Contact Bernie Backer, director of graduate recruitment and admission, at bernard.backer@slu.edu or 314-977-8144.