September was and is an extremely fruitful month (especially for the black-hat hackers) for news about data leaks and breaches:
- Uber suffers computer system breach, alerts authorities
- GTA 6 source code and videos leaked after Rockstar Games hack
- Revolut breach: personal and banking data exposed
In this blog post, we want to remind you how to keep your data safe when running your favorite open source databases.
Search engines like Shodan are an easy way to search for publicly available databases. Over 3.6 million MySQL servers found exposed on the Internet.
The best practice here is to run database servers in the isolated private network, even from the rest of your corporate network. In this case, you have a low risk of exposure even in the case of server misconfiguration.
If for some reason you run your database on the server in a public network, you still can avoid network exposure:
- Bind your server to the localhost or private IP address of the server
For example, for MySQL use bind-address option in your my.cnf:
bind-address = 192.168.0.123
- Configure your firewall to block access through a public network interface on the operating system
Users and passwords
To complement the network exposure story, ensure that your users cannot connect from just any IP address. Taking MySQL as an example, the following GRANT command allows to connect from one of the private networks only:
GRANT ALL ON db1.* TO 'perconaAdmin'@'192.168.0.0/255.255.0.0';
MySQL also has an auth_socket plugin, that controls the connection to the database through Unix sockets. Read more in this blog post: Use MySQL Without a Password (and Still be Secure).
Minimize the risk and do not use default usernames and passwords. SecList is a good example of bad choices for passwords: MySQL, PostgreSQL, and a misc list. Percona Platform provides users with Advisors (read more below) that preemptively check for misconfigured grants, weak passwords, and more.
So now we agree that a strong password is a must. Did you know that you can enforce it? This Percona post talks about Improving MySQL Password Security with Validation Plugin that performs such enforcement.
A strong password is set, great! To make your system even more resilient to security risks, it is recommended to have a password rotation policy. This policy can be manually executed, but also can be automated through various integrations, like LDAP, KMIP, HashiCorp Vault, and many more. For example, this document describes how Percona Server for MongoDB can work with LDAP.
There are two types of encryption when you talk about databases and ideally, you’re going to use both of them:
- Transport encryption – secure the traffic between client and server and between cluster nodes
- Data-at-rest encryption (or Transparent Data Encryption – TDE) – encrypt the data on a disk to prevent unauthorized access
With an unencrypted connection between the client and the server, someone with access to the network could watch all your traffic and steal the credentials and sensitive data. We recommend enabling network encryption by default. Read the following blog posts highlighting the details:
- Enabling and Enforcing SSL/TLS for PostgreSQL Connections
- Percona Server for MySQL Encryption Options and Choices
- Network (Transport) Encryption for MongoDB
Someone can get access to the physical disk or a network block storage and read the data. To mitigate this risk, you can encrypt the data on the disk. It can be done on the file system, block storage level, and with the database storage engine itself.
Tools like fscrypt or in-built encryption in ZFS can help with file system encryption. Public clouds provide built-in encryption for their network storage solutions (ex AWS EBS, GCP). Private storage solutions, like Ceph, also come with the support of data-at-rest encryption on the block level.
Percona takes security seriously, which is why we recommend enabling data-at-rest encryption by default, especially for production workloads. Percona Server for MySQL and Percona Server for MongoDB provides you with a wide variety of options to perform TDE on the database level.
Mistakes and misconfiguration can happen and it would be cool if there was a mechanism to alert you about issues before it is too late. Guess what – we have it!
Percona Monitoring and Management (PMM) comes with Advisors which are the checks that identify potential security threats, vulnerabilities, data loss or data corruption, and other issues. Advisors are the software representation of the years of Percona’s expertise in database security and performance.
By connecting PMM to Percona Platform, users can get more sophisticated Advisors for free, whereas our paid customers are getting even deeper database checks, which discover various misconfiguration or non-compliance gems.
Learn more about Percona Platform with PMM on our website and check if your databases are secured and fine-tuned right away.