Tightening up Linux "Security" & Installing MySQL

The first section describes the renaming of service files in /etc/rc.d/rc3.d/. The second section goes through my installation of MySQL on my server.

NOTE: I had to do an extra chown/chgrp operation on the /usr/local/mysql/data/mysql subdirectories that wasn't obvious from Ian's notes or the MySQL manual.txt.

Tightening up Linux "Security"

A quick review of Security of our Linux Servers suggested that we remove more services that weren't absolutely necessary. This was done by renaming start-up files in the /etc/rc.d/rc3.d/ directory so that when the Linux system starts up (at run-level 3), these services aren't started.

The tasks are to SSHtelnet into my Linux Server, and change to "root", then make these changes for: S99linuxconf, S14nfslock, S25netfs, and S35identd. Last trimester we'd made these changes for S60lpd and S80sendmail.

[kid@carson-city kid]$ su                                                       
Password: 
[root@carson-city kid]# 
[root@carson-city kid]#cd /etc/rc.d

[kid@carson-city rc.d]# ls rc3.d
K20nfs        K35smb       S14nfslock  S40atd       S90xfs
K20rstatd     K84ypserv    S16apmd     S40crond     S99linuxconf
K20rusersd    K92ipchains  S20random   S45pcmcia    S99local
K20rwalld     S05kudzu     S25netfs    S50inet      disabled_S60lpd
K20rwhod      S10network   S30syslog   S75keytable  disabled_S80sendmail
K34yppasswdd  S11portmap   S35identd   S85gpm

[root@carson-city rc3.d]# /sbin/runlevel
N 3

[root@carson-city rc3.d]# mv S99linuxconf disabled_S99linuxconf
[root@carson-city rc3.d]# mv S14nfslock disabled_S14nfslock
[root@carson-city rc3.d]# mv S25netfs disabled_S25netfs
[root@carson-city rc3.d]# mv S35identd disabled_S35identd

[root@carson-city rc3.d]# cd /usr/local
[root@carson-city local]# date
Sun Jan 14 19:29:18 EST 2001

[root@carson-city local]# shutdown -r now

By doing a "shutdown and restart", the changed services are stopped and those left enabled are restarted.

As a review, the regular "Linux System monitoring" tasks that we learned to do on a regular basis on our servers were:

! Regular "Linux System monitoring" tasks:
[root@carson-city local]# last | more
[root@carson-city local]# tail /var/log/messages
[root@carson-city local]# tail /var/log/secure
[root@carson-city local]# ls -l /tmp
[root@carson-city local]# df -k

! Regular "Apache monitoring" tasks:
[root@carson-city local]# cd /usr/local/apache/logs
[root@carson-city logs]# tail -40 access_log | more
[root@carson-city logs]# tail -40 error_log | more

Installing MySQL on Linux

/usr/local/mysql/manual.txt has a pretty good section on Installing the MySQL binary, but of course you don't get to see that until you're already half-way. (Don't try to print this, it looks to be about 700+ pages long).

Start by getting mysql-3.23.30-gamma-pc-linux-gnu-i686.tar.gz from http://www.mysql.com/downloads/mysql-3.23.html onto you Linux Server (I used SSH to FTP it to my /home/kid directory). Then I pretty much followed the steps I found in on-line manual.txt, EXCEPT the additional second execution of the chown and chgrp commands.

[root@carson-city /home]# cd /usr/local			# setup mysql user
[root@carson-city local]# /usr/sbin/groupadd mysql
[root@carson-city local]# /usr/sbin/useradd -g mysql mysql

							# unpack MySQL
[root@carson-city local]# gunzip < /home/kid/mysql-3.23.30-gamma-pc-linux-gnu-i
686.tar.gz | tar xvf -
... (lots of files get unzipped & untarred)

						# make a mysql symbolic link
[root@carson-city local]# ln -s mysql-3.23.30-gamma-pc-linux-gnu-i686 mysql
                                             
						# same as "configure"
[root@carson-city local]# cd mysql 
[root@carson-city mysql]# scripts/mysql_install_db
... (tables get created & installed)

						# set mysql file to mysql ownership
[root@carson-city mysql]# chown -R mysql /usr/local/mysql
[root@carson-city mysql]# chgrp -R mysql /usr/local/mysql

	##############################################################
	# NOTE - THESE ARE THE EXTRA STEPS I NEEDED to get MySQL to
	# start as 'user=mysql', other wise in /usr/local/mysql/data
	# in the 'host.log file (e.g. carson-city.log), you'll see:
	#   010115 20:23:33  mysqld started
	#   010115 20:23:33  /usr/local/mysql-3.23.30-gamma-pc-linux-gnu-i686
	#   /bin/mysqld: Can't find file: './mysql/host.frm' (errno: 13)
	#   010115 20:23:33  mysqld ended
	##############################################################

[root@carson-city mysql]# cd data
[root@carson-city data]# chown -R mysql mysql                                   
[root@carson-city data]# chgrp -R mysql mysql 

[root@carson-city data]# cd mysql
[root@carson-city mysql]# ls -l
	(the files should now look like:)

	-rw-rw----    1 mysql    mysql     0 Jan 15 20:10 columns_priv.MYD
	-rw-rw----    1 mysql    mysql  1024 Jan 15 20:10 columns_priv.MYI

        (and NOT)
	-rw-rw----    1 root     root      0 Jan 15 20:10 columns_priv.MYD
	-rw-rw----    1 root     root   1024 Jan 15 20:10 columns_priv.MYI

[root@carson-city mysql]# cd ..
[root@carson-city data]# cd ..
[root@carson-city mysql]# bin/safe_mysqld --user=mysql --log &                  
[1] 1597
[root@carson-city mysql]# Starting mysqld daemon with databases from /usr/local/
mysql-3.23.30-gamma-pc-linux-gnu-i686/data                                      

[root@carson-city mysql]# cd bin
[root@carson-city bin]# ./mysqladmin --version
./mysqladmin  Ver 8.13 Distrib 3.23.30-gamma, for pc-linux-gnu on i686
[root@carson-city bin]# ps -aex |grep mysql
 1597 pts/0    S      0:00 sh bin/safe_mysqld --user=mysql --log LESSOPEN=|/usr/
 1621 pts/0    S      0:00 /usr/local/mysql-3.23.30-gamma-pc-linux-gnu-i686/bin/
 1623 pts/0    S      0:00 /usr/local/mysql-3.23.30-gamma-pc-linux-gnu-i686/bin/
 1624 pts/0    S      0:00 /usr/local/mysql-3.23.30-gamma-pc-linux-gnu-i686/bin/
[root@carson-city bin]# ./mysqlshow
+-----------+
| Databases |
+-----------+
| mysql     |
| test      |
+-----------+
[root@carson-city bin]#

The following are some mysql commands I tried, completing this week's assignment:

[kid@carson-city bin]$ ./mysql mysql
ERROR 1044: Access denied for user: '@localhost' to database 'mysql'
[kid@carson-city bin]$ su
Password: 
[root@carson-city bin]# pwd
/usr/local/mysql-3.23.30-gamma-pc-linux-gnu-i686/bin

[root@carson-city bin]# ./mysql mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 4 to server version: 3.23.30-gamma-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer

mysql> show tables;
+-----------------+
| Tables_in_mysql |
+-----------------+
| columns_priv    |
| db              |
| func            |
| host            |
| tables_priv     |
| user            |
+-----------------+
6 rows in set (0.01 sec)

mysql> select host, user, password from user;
+--------------------------+------+----------+
| host                     | user | password |
+--------------------------+------+----------+
| localhost                | root |          |
| carson-city.marlboro.edu | root |          |
| localhost                |      |          |
| carson-city.marlboro.edu |      |          |
+--------------------------+------+----------+
4 rows in set (0.00 sec)

mysql> select * from db;
+------+---------+------+-------------+-------------+-------------+-------------+-------------+-----------+------------+-----------------+------------+------------+
| Host | Db      | User | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Grant_priv | References_priv | Index_priv | Alter_priv |
+------+---------+------+-------------+-------------+-------------+-------------+-------------+-----------+------------+-----------------+------------+------------+
| %    | test    |      | Y           | Y           | Y           | Y           | Y           | Y         | N          | Y               | Y          | Y          |
| %    | test\_% |      | Y           | Y           | Y           | Y           | Y           | Y         | N          | Y               | Y          | Y          |
+------+---------+------+-------------+-------------+-------------+-------------+-------------+-----------+------------+-----------------+------------+------------+
2 rows in set (0.00 sec)

mysql> show columns from host;
+-----------------+---------------+------+-----+---------+-------+---------------------------------+
| Field           | Type          | Null | Key | Default | Extra | Privileges                      |
+-----------------+---------------+------+-----+---------+-------+---------------------------------+
| Host            | char(60)      |      | PRI |         |       | select,insert,update,references |
| Db              | char(64)      |      | PRI |         |       | select,insert,update,references |
| Select_priv     | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Insert_priv     | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Update_priv     | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Delete_priv     | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Create_priv     | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Drop_priv       | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Grant_priv      | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| References_priv | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Index_priv      | enum('N','Y') |      |     | N       |       | select,insert,update,references |
| Alter_priv      | enum('N','Y') |      |     | N       |       | select,insert,update,references |
+-----------------+---------------+------+-----+---------+-------+---------------------------------+
12 rows in set (0.00 sec)

mysql> quit
Bye
[root@carson-city bin]#

Installing MySQL on Windows ME (laptop)

Once MySQL is installed, it's easy to start it and check it out:

C:\mysql\bin\mysqld 		! starts mysql in the background (no window)

C:\mysql\bin\mysqlshow
C:\mysql\bin\mysqlshow -u root mysql
C:\mysql\bin\mysqladmin version status proc
C:\mysql\bin\mysql test

C:\mysql\bin>mysqladmin version status proc
C:\MYSQL\BIN\MYSQLA~1.EXE  Ver 8.13 Distrib 3.23.30-gamma, for Win95/Win98 on i32
Copyright (C) 2000 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL license

Server version          3.23.30-gamma-debug
Protocol version        10
Connection              localhost via TCP/IP
TCP port                3306
Uptime:                 25 sec

Threads: 1  Questions: 3  Slow queries: 0  Opens: 5  Flush tables: 1  Open table
s: 0 Queries per second avg: 0.120  Memory in use: 8272K  Max memory used: 8304K

Uptime: 25  Threads: 1  Questions: 3  Slow queries: 0  Opens: 5  Flush tables: 1
  Open tables: 0 Queries per second avg: 0.120  Memory in use: 8272K  Max memory
 used: 8304K
+----+------+-----------+----+---------+------+-------+------------------+
| Id | User | Host      | db | Command | Time | State | Info             |
+----+------+-----------+----+---------+------+-------+------------------+
| 2  | ODBC | localhost |    | Query   | 0    |       | show processlist |
+----+------+-----------+----+---------+------+-------+------------------+

To shut MySQL down:

C:\mysql\bin>
C:\mysql\bin>mysqladmin -u root shutdown

Deleting a User and the Previous MySQL files

As an aside, I was confused by the work I'd done the night before, so I wanted to delete the mysql accound I had created and delete everything I'd try install then - which turned out to be pretty easy.

[kid@carson-city kid]$ su                                                       
Password: 
[root@carson-city kid]#
[root@carson-city kid]# cd /etc 		# remove mysql user & group
[root@carson-city /etc]# emacs /etc/passwd
		(removing "mysql::501:501::/home/mysql:")
[root@carson-city /etc]# emacs /etc/group
		(removing "mysql:x:501:")

[root@carson-city /etc]# cd /home		# remove mysql directory
[root@carson-city /home]# rm -fR mysql

[root@carson-city /home]# cd /usr/local		# remove the old mysql files
[root@carson-city local]# rm -fR  mysql-3.23.30-gamma-pc-linux-gnu-i686  



© Copyright 2001, Bruce Lührs
Southern New Hampshire