I'm looking for a way to secure MySQL data in particular tables for example settings table. Ideal solution would hook up to database and log all INSERT, UPDATE and DELETE requests to particular tables, preferably on low level.

I believe on one of INFOSEC events there was some solutions that allowed to monitor requests to database server and trigger various actions, but I don't remember names of those solutions.

  • 1
    You can enable logging in the mysql config file, then view the logfile with mysqlbinlog (e.g. for Linux). – ott-- Aug 19 '13 at 15:15
  • @ott-- that's quite close to what I'm looking for. Are you aware of any apps that can sit in background and monitor specific database/tables? – Nazariy Aug 19 '13 at 16:33
  • There are some monitoring apps, either from mysql.com or others, but they are not open source. Otoh, you could check Using Triggers from the mysql manual. – ott-- Aug 19 '13 at 19:14
  • Have you tried to use simple MySQL databases monitoring tools which have benc reated for this purpose? I know some of the tool e.g.Anturis(htpp://www.anturis.com), then Percona (htp://www.percona.com). I think it can be an easier way. – user233881 Aug 23 '13 at 7:28

you can create additional users with different privileges for different tables

see the following for a better explanation: https://stackoverflow.com/questions/6288554/mysql-grant-all-privileges-to-database-except-one-table

doing this would mean you could create a user able to insert/update/delete all other tables apart from the settings (or other tables).

I hope this helps :)

|improve this answer|||||
  • It's slightly more than that, application have access to all tables, but some tables does not change often and mostly contain constant values, like payment processor ID and token. Theoretically, malicious user can change this values over weekend and put it back to original state after. Alternatively how would you make sure that user table was not changed? – Nazariy Aug 19 '13 at 14:50
  • 1
    if a user is able to change values not related to them or you need certain things to be non-editable you need to rethink your front end application. If you are giving users direct access to the tables and you don't want to implement my suggested method im not sure what you can do about it (apart from not giving users access to ur tables). – micb Aug 19 '13 at 14:58
  • Unfortunately I'm not able to rebuilt entire commercial solution and keep it flexible at same time. For a file system I can use GIT to monitor changes and revert to correct revision, I can even automate this process, but for database - it's slightly different. – Nazariy Aug 19 '13 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.