Securing MySQL for production server.

Question

Hello,
I am about to start to build a server running 10.5.3 to host a web site with a MySQL back end. Whilst doing this i will be learning about MySQL as i go along. The question i would like to ask though before i get started is What do i need to do initially to secure the MySL installation on a 10.5.3 Leopard Server?
Has Apple secured it as much as possible out of the box, apart form setting the root password or do i need to do further configuring to secure other areas.
PS. Is there such a tool that will check for any security vulnerabilities in your configuration before it goes live?
Thanks in advance for any help.

Answer 1

There are multiple attacks targeting Joomla presently active, based on what the botnets are aiming at the (non-Joomla) web sites I manage.
The web apps are the target here. Joomla, front and center. Yes, the attackers can want into the database, but they're going to try to gain that access through the very same applications that you have already authorized database access. Through your content management system (CMS). If Joomla can access and modify the database, then an attack based on SQL Injection or XSS can itself gain that same access.
Having the DB located local, remote or even on Mars (well, other than the latency) does not alter the security situation, as the target (Joomla) is authorized access into the database.
I don't prefer to connect Mac OS X Server (directly) to the web. For something like this, I use an out-board firewall, set to pass ports 80 and 443, and other specific ports as required, If you connect directly, you have to be much more careful with your management and installation. With Mac OS X Server behind a firewall, you can keep (most of) the port attacks blocked out at the firewall, and not directly on your server. If you install or reconfigure something that opens a port (whether you realize it or not) and you don't have an outboard firewall, that port can be accessed remotely.
I do use the Mac OS X Server firewall, in conjunction with the outboard firewall. I don't prefer to use the host firewall -- in isolation -- in an internet-facing server environment. And I keep that outboard firewall locked down.
One area of database security here involves getting recoverable copies off the host for use if the host becomes compromised. Periodically test the restores, too. And recognize you might have to drop back some number of snapshots, until you find a copy of your database and your web directories that isn't compromised.
Get on the Joomla security notification lists (the content management system I use offers those; haven't specifically checked Joomla), and do lock down your web server. Figure out who owns Joomla or other security updates, and figure out who owns archival processing and recovery, and figure out what you want to do if your server becomes compromised.
For the Apache configurations, you want to block access to all but specified directories, and you can want to block the .htaccess and other site-specific files. Access into your defaults, directory traversals, file specifications, etc., are typically blocked via conf directive or .htaccess. Joomla should have recommendations for this somewhere in its documentation. If not, other CMS pacakges have descriptions of locking down Apache, though various details of this process tend to be somewhat CMS-specific. (Check the [Drupal|http://drupal.org] site; I know that CMS has this sort of thing documented.)
You'll want to watch the attacks, too.
It usually takes me a half-hour or so to fully set up and test Apache, building from my templates and customizing those for the particular CMS install I'm working on. Way more than could be easily included here.