MySQL安全基線是指一套規(guī)范和標準，它可以幫助組織和企業(yè)確保他們的MySQL數(shù)據(jù)庫實例是安全和規(guī)范的。對于那些開設(shè)了共享主機和云主機的提供商而言，實施基線建議是至關(guān)重要的。以下是MySQL安全基線的建議和最佳實踐。

#強制使用SSL/TLS
mysql>GRANT USAGE ON *.* TO 'user'@'hostname' REQUIRE SSL;
#啟用防火墻
systemctl start firewalld
systemctl enable firewalld
firewall-cmd --zone=public --add-port=3306/tcp --permanent
firewall-cmd --reload
#禁用遠程root登錄
mysql>DROP USER 'root'@'%';
mysql>CREATE USER 'root'@'localhost' IDENTIFIED BY 'password';
#使用強密碼
mysql>CREATE USER 'user'@'localhost' IDENTIFIED BY '*_..jns1Hro';
mysql>CREATE USER 'user'@'%' IDENTIFIED BY '*_..jns1Hro';
#僅允許指定IP訪問
mysql>CREATE USER 'user'@'10.1.1.2' IDENTIFIED BY 'password';
mysql>GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP ON dbname.* TO 'user'@'10.1.1.2';
#管理安全日志
nano /etc/my.cnf
[mysqld]
general_log = on
log_output = file
general_log_file=/var/log/mysql/mysql_query.log
#禁用不需要的功能
nano /etc/my.cnf
[mysqld]
skip-networking=true
skip-name-resolve=true
#啟用參數(shù)文件加密
mysql>SET PERSIST server_encryption_password='my_strong_password';
#定期備份和恢復(fù)
0 0 * * * mysqldump -uroot -ppassword dbname >/backup/dbname.sql
0 1 * * * mysql -uroot -ppassword=<(openssl rand -base64 32) dbname< /backup/dbname.sql