How to secure MSSQL and MySQL

[sharron]

You can easily secure your MSSQL and MySQL by using firewall.

You may wish to enable remote access to your MS SQL server or MySQL server. But it is strongly recommended that this service be firewalled and only your IP address allowed for remote access to this port.

You can easily do this by the following method:-

Start > Control Panel > Windows Firewall > Exceptions >

Add Port > Name = MSSQL | Port = 1443 | TCP > Change Scope > Custom list > Your IP address as listed at http://whatisimyip.com
Add Port > Name = MySQL | Port = 3306| TCP > Change Scope > Custom list > Your IP address as listed at http://whatismyip.com

[bod-jack]

Users accounts are only as secure as the passwords used to protect them.Therefore for this reason, the first thing you should remember to do is when you install MySQL is assign a password to the MySQL root account (empty by default). Once you've closed this gaping hole, the further step is to require that every user account must have a password and ensure that passwords do not use easily-recognizable

Note: Use the MySQL --secure-authentication option to prevent the use of older, less secure MySQL password formats.

[carl]

You must check the permissions of configuration files

It is always admired that to make server connections faster and more convenient, both users and server administrators store their user account passwords in their per-user MySQL options file.
However, this password is saved in plain-text within the file and can easily be read by others. Therefore, it is very important to ensure that such per-user configuration files are not viewable by other users of the system, and are stored in non-public locations.You would want the per-user configuration to be stored in the user's home directory with permissions 0600.

[Christina]

From many days I am using MySQL and jsp's on a linux server with tomcat apache, and a good firewall.the connection through my website to the database is also secured with custom made servlets, every request sent to the database needs to go through that servlet and thus i can secure certain tables depending on what user logged on.