I am setting up a new MySQL server in the office. The client app, connecting from the same LAN, is now in beta testing. So I can still change authentication system and other stuff there. Currently I decided to compile the string of private key into the app.
The client first provides the key and gets connected to the root account in DB. Then, a (particular) password hash is requested from the DB, based on the username inputted. If the hash is equal to the one made out of the password-box contents, the actual app starts.
I decided to encrypt all data stored there (use LVM, basically), but my boss is very concerned on the case where the server is stolen together with an employee's laptop (some nice guys have password PostIt's on screen edges).
I would be grateful for any info on:
- Restricting client connections to a certain timeframe (7AM-7PM, Mon-Fri).
- Restricting any connections or better, even logging in into CentOS (or any other distribution, if you have suggestions) by the location.
The only thing that came to my mind by now, is that shared printer and a small FTP for keeping scanned stuff can play a role in assuring that the server is in fact still on our network and not stolen and taken from the office. Say, I can verify the name (model) of the printer and check hash-sum of some file I quickly download from FTP.
If it is a suitable solution, please give details on how to manipulate the server security itself. Like, I can make a script that would return 1 or 0 in case of the FTP/printer requirement is met, but how do I use the result of this check?