MySQL login is required for both database administrators and users for untroubled accessing MySQL. Some services and company rules requires more strict procedures for choosing and using MySQL login; others may be more volatile or free regarding security matters.
But some MySQL login techniques are quite useful in almost all MySQL setups, even as a reference if not as a direct tip. These techniques include some vital matters such as accessing MySQL login to database as root, using PHP MySQL login scripts and avoiding keeping inactive or "dead" MySQL login data active.
Let us tell you some words about benefits and problems of these matters. For more information you may lurk Internet, finding tons of other useful tips about MySQL login rules.
Theme One: Using Root MySQL Login
MySQL account sign in as root gives all the privileges for signed user. Many malware strategies are based on this feature.
To avoid it, just rename the root user:
- mysql> RENAME USER root TO user_alpha;
Then disable the root MySQL account:
- mysql> use mysql;
- mysql> update user set user="new_user" where user="root";
- mysql> flush privileges;
At last, reset the password for the new root user:
- mysql> SET PASSWORD FOR 'user_alpha'@'%hostname' = PASSWORD('newpass');
Now all software (both legally and illegally accessing MySQL) can't access MySQL through root MySQL login. This may require additional job e.g. re-writing some administering scripts, but attacks using root will be stopped, anyway!
Theme Two: Using PHP MySQL Login Scripts
These are a lot of PHP MySQL login scripts available for commercial or educational purposes. Almost all scripts use the same basic algorithm to grant PHP MySQL login and password. As a result, there is quite a lot of malware existed trying accessing these automatic MySQL sign in data.
What to be done? Firstly, use password generator scripts along with PHP MySQL login scripts as frequently as you can to grant a casual user temporary MySQL login. (Obviously, you must not copy sample user names and passwords from scripts published on Internet resources!)
The second security measure is creating a table logging all MySQL login command attempts to avoid brute-forcing breakdown of your security system. This technique is common for most public resources but for less posh projects this simple and clever security method is constantly underestimated.
Theme Three: Removing Inactive MySQL Users
A contemporary scandal in Russia where millions of user logins for two biggest Russian social networks are leaked to open access due to hacking attack was a remembering that all old or inactive accounts are just a fast-food for malware.
When some "evil-doing" program or script tries to use MySQL login command under the account of active user, some signs of it are quite noticeable. User or administrator may react quickly, setting up an alert and avoiding many possible consequences of malware attack. If the user is inactive, these signs can be unnoticed!
So delete any obsolete MySQL login as quickly as possible. At least, if you do not want to remove a particular MySQL account due to some circumstances, lower this account's privileges to the minimal level, so if some user or program will grab access to this account the possibilities of using it will be quite restricted.
Save your MySQL data, try Handy Backup - easy to use MySQL Backup Software!