Having MySQL using auth_socket as default authentication mechanism for the root user scares me, so I change it to password authentication with rigid controls on password quality and documentation.

If a user manage to have root access to this linux machine that has a MySQL database but doesn't have the password to log in into the service, he still can copy/modify/destroy the data?

  • 1
    Yes, root can do pretty much anything. – AndrolGenhald Jul 10 '18 at 14:48

The root user will have access to, at the very least, the database file that is stored on the computer. This means reguardless of how the service is configured they can copy and delete the data. If your databse is not encrypted by some means he will be able to modify the data too.

  • And even if it's encrypted, the encryption key is stored on the computer and root have access to every single file. – ThoriumBR Jul 10 '18 at 15:03
  • @ThoriumBR that would be most cases, but he could use a key not from the machine too. – rhymsy Jul 11 '18 at 16:11
  • @rhymsy That key could be read from system memory in the decryption process. Even if it is on a different machine, you still need the key to read the data. – Francisco Zanatta Jul 12 '18 at 13:59
  • @Francisco Zanatta, yes, I hadn't thought of that. Thanks – rhymsy Jul 12 '18 at 14:01

You obviously know the answer now: yes. However, it is even easier than it seems. As a root user you can actually reset the root password for a MySQL installation. I've had to do this before: I had a brand new installation and I forgot to record the MySQL root password. It took less than 5 minutes to reset the root password in MySQL, and I had full access to the MySQL database after doing so - it made no changes to anything in MySQL at all (other than the root password).

Of course even that might not matter. If your database server and application server are one machine then a smart attacker can just look at your application, see how it is authenticating (typically as simple as reading credentials out of source code or an environment configuration), and login like that.

It would be very difficult to come up with a way to lock the root user out of MySQL, and if you managed to do it you would probably be more likely to hurt yourself than a malicious user. In general if an unauthorized user gains root access to your server, you're pretty much hosed.

  • That was also very helpful. It seems the only hope is to restrict access to the root user. – Francisco Zanatta Jul 11 '18 at 12:26
  • @FranciscoZanatta If you mean restrict other people's access to the root user then that is definitely the right idea - the best way to protect root is by making sure to not use root by default - just use a standard user account. What's not clear is your exact concern. Again, root has full access to everything, so the goal is to keep attackers out of root in the first place - not to keep root out of anything. What is your specific concern, or what are you trying to do – Conor Mancone Jul 11 '18 at 14:22
  • I would like to have MySQL data safe even with the llinux root account compromised. That seems to be impossible, given that root has access to the data files MySQL writes to. I still believe that using password authentication for the root MySQL user is better than using auth_socket authentication that ships with MySQL server installation in Ubuntu and possibly other Debian based systems. Do you have thougths on that? – Francisco Zanatta Jul 11 '18 at 21:04
  • I really doubt there is anyway to keep MySQL data safe from a root user. The example I gave shows how easy it is for the root user to change the MySQL password, specifically with password authentication. Even if you came up with some sort of way to encrypt your MySQL data files, root could still read the system memory to find results there, or replace the MySQL binary with one that auto dumps databases, etc... There is no point in trying to protected MySQL from root. You should focus on protecting root from the world. – Conor Mancone Jul 12 '18 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.