You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/guides/database/database_mariadb-server.md
+29-29Lines changed: 29 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,27 +12,27 @@ tags:
12
12
13
13
## Prerequisites
14
14
15
-
* A Rocky Linux server
16
-
* Proficiency with a command-line editor (using _vi_ in this example)
17
-
* A heavy comfort level with issuing commands from the command-line, viewing logs, and other general systems administrator duties
18
-
* An understanding of _mariadb-server_ databases is helpful
19
-
* Run all commands as root or with _sudo_
15
+
- A Rocky Linux server
16
+
- Proficiency with a command-line editor (using *vi* in this example)
17
+
- A heavy comfort level with issuing commands from the command-line, viewing logs, and other general systems administrator duties
18
+
- An understanding of *mariadb-server* databases is helpful
19
+
- Run all commands as root or with *sudo*
20
20
21
21
## Introduction
22
22
23
-
The _mariadb-server_ and it is client _mariadb_ are the open source alternatives to _mysql-server_ and _mysql_, and they share command structure. _mariadb-server_ is running on many web servers, due to the popular [Wordpress CMS](https://wordpress.org/) which requires it. This database, though, has many other uses.
23
+
The *mariadb-server* and it is client *mariadb* are the open source alternatives to *mysql-server* and *mysql*, and they share command structure. *mariadb-server* is running on many web servers, due to the popular [Wordpress CMS](https://wordpress.org/) which requires it. This database, though, has many other uses.
24
24
25
25
If you want to use this along with other tools for hardening a web server, refer back to the [Apache Hardened Web Server guide](../web/apache_hardened_webserver/index.md).
26
26
27
27
## Installing `mariadb-server`
28
28
29
-
You need to install _mariadb-server_:
29
+
You need to install *mariadb-server*:
30
30
31
31
`dnf install mariadb-server`
32
32
33
33
## Securing `mariadb-server`
34
34
35
-
To strengthen the security of _mariadb-server_ you need to run a script, but before you do, you need to enable and start mariadb:
35
+
To strengthen the security of *mariadb-server* you need to run a script, but before you do, you need to enable and start mariadb:
36
36
37
37
`systemctl enable mariadb`
38
38
@@ -56,7 +56,7 @@ Next, run this command:
56
56
57
57
This brings up a dialog:
58
58
59
-
```
59
+
```text
60
60
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
61
61
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
62
62
@@ -68,11 +68,11 @@ so you should just press enter here.
68
68
Enter current password for root (enter for none):
69
69
```
70
70
71
-
Since this is a brand-new installation, no root password set. Just hit enter here.
71
+
Since this is a brand-new installation, no root password set. Just hit ++enter++ here.
72
72
73
73
The next part of the dialog continues:
74
74
75
-
```
75
+
```text
76
76
OK, successfully used password, moving on...
77
77
78
78
Setting the root password ensures that nobody can log into the MariaDB
@@ -81,24 +81,24 @@ root user without the proper authorisation.
81
81
Set root password? [Y/n]
82
82
```
83
83
84
-
You absolutely _do_ want to have a root password set. You'll want to figure out what this should be and document it in a password manager somewhere so that you can pull it up if necessary. Start by hitting 'Enter' to accept the default "Y". This will bring up the password dialog:
84
+
You absolutely *do* want to have a root password set. You'll want to figure out what this should be and document it in a password manager somewhere so that you can pull it up if necessary. Start by hitting ++enter++ to accept the default "Y". This will bring up the password dialog:
85
85
86
-
```
86
+
```text
87
87
New password:
88
88
Re-enter new password:
89
89
```
90
90
91
91
Enter your chosen password and then confirm it by entering it again. If this is successful, you will get the following dialog:
92
92
93
-
```
93
+
```text
94
94
Password updated successfully!
95
95
Reloading privilege tables..
96
96
... Success!
97
97
```
98
98
99
99
Next the dialog deals with the anonymous user:
100
100
101
-
```
101
+
```text
102
102
By default, a MariaDB installation has an anonymous user, allowing anyone
103
103
to log into MariaDB without having to have a user account created for
104
104
them. This is intended only for testing, and to make the installation
@@ -108,11 +108,11 @@ production environment.
108
108
Remove anonymous users? [Y/n]
109
109
```
110
110
111
-
The answer here is "Y" so just hit 'Enter' to accept the default.
111
+
The answer here is "Y" so just hit ++enter++ to accept the default.
112
112
113
113
The dialog proceeds to the section dealing with allowing the root user to login remotely:
114
114
115
-
```
115
+
```text
116
116
... Success!
117
117
118
118
Normally, root should only be allowed to connect from 'localhost'. This
@@ -121,11 +121,11 @@ ensures that someone cannot guess at the root password from the network.
121
121
Disallow root login remotely? [Y/n]
122
122
```
123
123
124
-
root should only be needed locally on the machine. So accept this default as well by hitting 'Enter'.
124
+
root should only be needed locally on the machine. So accept this default as well by hitting ++enter++.
125
125
126
-
The dialog then moves on to the 'test' database that is automatically installed with _mariadb-server_:
126
+
The dialog then moves on to the 'test' database that is automatically installed with *mariadb-server*:
127
127
128
-
```
128
+
```text
129
129
... Success!
130
130
131
131
@@ -136,11 +136,11 @@ before moving into a production environment.
136
136
Remove test database and access to it? [Y/n]
137
137
```
138
138
139
-
Again, the answer here is the default, so just hit 'Enter' to remove it.
139
+
Again, the answer here is the default, so just hit ++enter++ to remove it.
140
140
141
141
Finally, the dialog asks you if you want to reload the privileges:
142
142
143
-
```
143
+
```text
144
144
- Dropping test database...
145
145
... Success!
146
146
- Removing privileges on test database...
@@ -152,9 +152,9 @@ will take effect immediately.
152
152
Reload privilege tables now? [Y/n]
153
153
```
154
154
155
-
Again, hit 'Enter' to do this. If all goes well, you will receive this message:
155
+
Again, hit ++enter++ to do this. If all goes well, you will receive this message:
156
156
157
-
```
157
+
```text
158
158
... Success!
159
159
160
160
Cleaning up...
@@ -169,23 +169,23 @@ MariaDB will now be ready to use.
169
169
170
170
### Rocky 9.0 changes
171
171
172
-
Rocky Linux 9.0 uses `mariadb-server-10.5.13-2` as the default mariadb-server version. As of version 10.4.3, a new plugin is automatically enabled in the server which changes the `mariadb-secure-installation` dialog. That plugin is `unix-socket` authentication. [This article](https://mariadb.com/kb/en/authentication-plugin-unix-socket/) explains the new feature well. Essentially, using unix-socket authentication uses the logged-in user's credentials to access the database. It makes it so that if the root user, for example, logs in and then uses `mysqladmin` to create or delete a database (or any other function) that no password is needed for access. Same works with `mysql`. It also means there is no password to compromise remotely. This depends on the security of the users set up on the server for all of the database protection.
172
+
Rocky Linux 9.0 uses `mariadb-server-10.5.13-2` as the default mariadb-server version. As of version 10.4.3, a new plugin is automatically enabled in the server which changes the `mariadb-secure-installation` dialog. That plugin is `unix-socket` authentication. [This article](https://mariadb.com/kb/en/authentication-plugin-unix-socket/) explains the new feature well. Essentially, using unix-socket authentication uses the logged-in user's credentials to access the database. It makes it so that if the root user, for example, logs in and then uses `mysqladmin` to create or delete a database (or any other function) that no password is needed for access. Same works with `mysql`. It also means there is no password to compromise remotely. This depends on the security of the users set up on the server for all of the database protection.
173
173
174
174
The second dialog during the `mariadb-secure-installation` after the password is set for the administrative user is:
175
175
176
-
```
176
+
```text
177
177
Switch to unix_socket authentication Y/n
178
178
```
179
179
180
180
The default here is "Y", but even if you answer "n", with the plugin enabled, a password is not requested for the user, at least not from the command line interface. You can specify either password or no password and they both work:
181
181
182
-
```
182
+
```bash
183
183
mysql
184
184
185
185
MariaDB [(none)]>
186
186
```
187
187
188
-
```
188
+
```bash
189
189
mysql -p
190
190
Enter password:
191
191
@@ -196,4 +196,4 @@ For more information on this feature, refer to the link above. There is a way to
196
196
197
197
## Conclusion
198
198
199
-
A database server, such as _mariadb-server_, can be used for many purposes. Because of the popularity of the Wordpress CMS, it is often found on web servers. Before you run the database in production, however, it is a good idea to strengthen its security.
199
+
A database server, such as *mariadb-server*, can be used for many purposes. Because of the popularity of the Wordpress CMS, it is often found on web servers. Before you run the database in production, however, it is a good idea to strengthen its security.
0 commit comments