MariaDB Honeypot

oli.sennhauser@fromdual.com (Oli Sennhauser) — Thu, 06 Mar 2025 09:50:18 +0000

In our MariaDB advanced training courses, which we hold approximately every two months, we use machines that are directly exposed to the Internet with a public IP address. Warning: You should NEVER expose a database directly to the Internet without protection! Typically, it takes less than 72 hours (3 days) before we are exposed to the first external access attempts.

MariaDB Push Replication

oli.sennhauser@fromdual.com (Oli Sennhauser) — Mon, 11 Jan 2021 17:29:50 +0000

How to make MariaDB Pull Replication as secure as possible

A normal MariaDB Replication is a Pull Replication. This means that a Slave connects to its Master and gathers or better requests Binary Log information from the Master and applies them in a streaming way.

Oracle releases MySQL security vulnerability fixes 2018-01

oli.sennhauser@fromdual.com (Oli Sennhauser) — Wed, 17 Jan 2018 11:27:28 +0000

As in every quarter of the year Oracle has released yesterday its recommendation for the MySQL security updates. This is called, in Oracle terminology, Critical Patch Update (CPU) Advisory.

MySQL and MariaDB authentication against pam_unix

oli.sennhauser@fromdual.com (Oli Sennhauser) — Mon, 13 Feb 2017 18:02:08 +0000

The PAM authentication plugin is an extension included in MySQL Enterprise Edition (since 5.5) and in MariaDB (since 5.2).

Non-standard database set up with SELinux

oli.sennhauser@fromdual.com (Oli Sennhauser) — Tue, 13 Dec 2016 15:26:19 +0000

What is SELinux?

The Security-Enhanced Linux is an extension to the Linux Kernel, made by the NSA (National Security Agency). It implements Mandatory Access Controls (MAC), which allow an administrator to define, how applications and users can access resources on a system.

MySQL and MariaDB Security

oli.sennhauser@fromdual.com (Oli Sennhauser) — Fri, 18 Jan 2013 09:27:09 +0000

Overview

MySQL Security Products

Database Firewall: GreenSQL
MySQL Database Security: McAfee

Useful Security Links

STIG Update: DISA releases the MariaDB Enterprise 10.x Security Technical Implementation Guide
OWASP: Database Security Cheat Sheet
CIS MySQL 4.1/5.0/5.1 Benchmark (v1.0.2)
CIS Oracle MySQL Community Server 5.6 Benchmark (v1.1.0)
CIS Oracle MySQL Community Server 5.7 Benchmark (v1.0.0)
CIS Oracle MySQL Enterprise Edition 5.6 Benchmark (v1.1.0)
CIS Oracle MySQL Enterprise Edition 5.7 Benchmark (v1.0.0)
MySQL Documentation: Security
BSI certified database servers
CVE Details
RHSA-2013:0121-1
RHSA-2012:1462-1
full-disclosure@lists.grok.org.uk
MySQL Security Forum
MySQL SQL Injection Cheat Sheet

Security Vulnerabilities Fixed in MariaDB

Oracle Critical Patch Update (CPU) Advisory for MySQL

Oracle Critical Patch Update Advisory - Overview
Oracle Critical Patch Update Advisory - October 2024 (45 fixes / 9.1 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2024 (37 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2024 (36 fixes / 7.5 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2024 (40 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2023 (37 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2023 (24 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2023 (34 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2023 (37 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2022 (37 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2022 (34 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2022 (43 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2022 (78 fixes / 7.5 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2021 (66 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2021 (41 fixes / 8.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2021 (49 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2021 (43 fixes / 7.5 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2020 (53 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2020 (40 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2020 (45 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2020 (19 fixes / 7.5 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2019 (34 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2019 (45 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2019 (45 fixes / 7.5 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2019 (30 fixes / 9.1 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2018 (38 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2018 (31 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2018 (33 fixes / 7.7 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2018 (25 fixes / 8.1 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2017 (25 fixes / 8.8 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2017 (30 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2017 (39 fixes / 10.0 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2017 (27 fixes / 8.8 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2016 (31 fixes / 7.5 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2016 (22 fixes / 8.1 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2016 (31 fixes / 9.8 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2016 (22 fixes / 7.2 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2015 (30 fixes / 9.0 max score), verbose text form
Oracle Critical Patch Update Advisory - July 2015 (18 fixes / 6.5 max score), verbose text form
Oracle Critical Patch Update Advisory - April 2015 (26 fixes / 10.0 max score), verbose text form
Oracle Critical Patch Update Advisory - January 2015 (9 fixes / 7.5 max score), verbose text form
Oracle Critical Patch Update Advisory - October 2014 (24 fixes / 8.0 max score)
Oracle Critical Patch Update Advisory - July 2014 (10 fixes / 6.5 max score)
Oracle Critical Patch Update Advisory - April 2014 (14 fixes / 6.5 max score)
Oracle Critical Patch Update Advisory - January 2014 (18 fixes / 10.0 max score)
Oracle Critical Patch Update Advisory - October 2013 (8 fixes / 8.5 max score)
Oracle Critical Patch Update Advisory - July 2013 (18 fixes / 6.8 max score)
Oracle Critical Patch Update Advisory - April 2013 (25 fixes / 6.8 max score)
Oracle Critical Patch Update Advisory - January 2013 (18 fixes / 9.0 max score)
Oracle Critical Patch Update Advisory - October 2012 (15 fixes / 9.0 max score)
Oracle Critical Patch Update Advisory - July 2012 (6 fixes / 6.8 max score)
Oracle Critical Patch Update Advisory - April 2012 (6 fixes / 6.8 max score)
Oracle Critical Patch Update Advisory - January 2012 (27 fixes / 5.5 max score)

RedHat/CentOS vulnerabilities by CVE name

Red Hat vulnerabilities by CVE name for MySQL

MariaDB Security Risk Matrix

oli.sennhauser@fromdual.com (Oli Sennhauser) — Tue, 25 Feb 2020 15:49:45 +0000

Security on FromDual GmbH