Datenbank MariaDB

Für das LAMP-System installieren wir uns jetzt noch eine MySQL/MariaDB Datenbank.

apt install mariadb-server mariadb-client
# Login Test via Shell mysql from root and Standarduser: OK

Eine beispielhafte Absicherung mittels mysql_secure_installation:

root@vm-lpic-server:/var/www/html# mysql_secure_installation


In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n
... skipping.

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] Y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

Hier kann man sehen, dass das Securing Script aktuell netter Weise eine Abfrage zur Nutzung des Plugins unix_socket bereitstellt.

Unsere Technik sollten wir natürlich gleich wieder testen.

joebserver@vm-lpic-server:~$ mysql -u root -h localhost -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 53
Server version: 10.5.11-MariaDB-1 Debian 11

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
| Database           |
| information_schema |
| mysql              |
| performance_schema |
3 rows in set (0.000 sec)

MariaDB [(none)]> select user, password, host, plugin from user;
ERROR 1046 (3D000): No database selected
MariaDB [(none)]> use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [mysql]> select user, password, host, plugin from user;
| User        | Password                                  | Host      | plugin                |
| mariadb.sys |                                           | localhost | mysql_native_password |
| root        | *B4A975C0F9C44C243BCBE0F3B7EDA5CAC5073293 | localhost | mysql_native_password |
| mysql       | invalid                                   | localhost | mysql_native_password |
3 rows in set (0.001 sec)

MariaDB [mysql]>

Neben dem von uns nutzbaren User root sieht man bei Datenbanken dann auch sogenannte Reservierte Benutzerkonten mit unterschiedlichen Nutzungen im System.

In diesem Fall findet ein SHOW CREATE USER 'mariadb.sys'@localhost; heraus, dass das Konto deaktiviert (locked) ist.

Und das Password invalid ist nicht wörtlich zu nehmen, sondern bedeutet, dass kein Password sauber mit SET PASSWORD gesetzt wurde.