Securing MariaDB: Essential Configuration and Hardening Steps
1. Update and patch
- Keep MariaDB up to date — install the latest stable release and security patches for the OS and related packages.
2. Use strong authentication
- Enable strong passwords for all accounts; enforce complexity and rotation policies.
- Remove or disable anonymous users: DELETE anonymous accounts and test accounts.
- Disable remote root login: restrict root to localhost and create administrative accounts with restricted privileges.
- Use plugin-based authentication (e.g., unix_socket) where appropriate.
3. Principle of least privilege
- Grant minimal privileges to each user (GRANT only required privileges on specific databases/tables).
- Avoid using root for application connections; create dedicated, limited users.
4. Network security
- Bind to localhost or internal IPs using the bind-address setting unless external access is required.
- Use firewalls (iptables, nftables, cloud security groups) to restrict access to MariaDB ports (default 3306).
- Use TLS/SSL for client-server connections: generate certificates, set require_secure_transport=ON, and configure server and client to use TLS.
5. Encryption
- Enable InnoDB tablespace and redo log encryption if needed.
- Encrypt backups and snapshots at rest and during transit.
6. Secure configuration settings
- Set skip_symbolic_links=ON to prevent symlink-based attacks.
- Enable sql_mode with STRICT settings (e.g., STRICT_TRANS_TABLES) to reduce unexpected behavior.
- Disable or restrict LOCAL INFILE if not needed.
- Configure max_connect_errors and connection limits to mitigate DoS.
7. Auditing and logging
- Enable general and audit logs (audit plugin) to track connections, queries, and changes.
- Secure log files with proper permissions and ship to a central log server or SIEM.
- Monitor error logs for suspicious activity.
8. Backup and recovery
- Regular automated backups with tested restore procedures.
- Store backups securely (encrypted, access-controlled).
- Keep backups offsite or in a different failure domain.
9. Hardening OS and file permissions
- Run MariaDB with a dedicated low-privilege system user.
- Restrict filesystem permissions for database files, configuration files, and keys.
- Disable unused services and lock down the OS (apply CIS or distro-specific hardening guides).
10. Plugins and stored routines
- Audit and restrict UDFs and plugins; only enable trusted plugins.
- Restrict CREATE/ALTER/EXECUTE on routines to trusted DBAs.
11. Monitoring and alerting
- Implement monitoring (performance, connections, replication health) and alerting for anomalous patterns.
- Track failed login attempts and unusual query volume.
12. Replication and high availability security
- Use replication users with limited privileges and secure replication traffic with TLS.
- Protect failover orchestration tools and ensure authentication between nodes.
13. Regular security reviews and testing
- Perform periodic vulnerability scans, configuration reviews, and penetration tests.
- Review user accounts, privileges, and inactive databases regularly.
Quick checklist (short)
- Update MariaDB and OS.
- Remove anonymous users; disable remote root.
- Enforce least privileges.
- Bind to safe interfaces; use firewall.
- Require TLS for connections.
- Encrypt data at rest and backups.
- Enable auditing and monitor logs.
- Harden OS and file permissions.
- Regular backups and tested restores.
- Periodic security reviews and testing.
If you want, I can generate a checklist tailored to your MariaDB version and environment (Linux distribution, cloud/on-prem, replication).
Leave a Reply