0

I'm working in an environment where I need to ensure that developers only connect to our application's MySQL database using the username of their Unix account. The driver behind this is to have traceability via MySQL general logs from queries run, back to the user running them. Thus far I haven't found any ideal solutions for this, I have some imperfect ones, and I'm hoping to get some better ideas.

Developers have access to the credentials used by the application (they can access them by logging into the host). I am working on a solution to restrict access to the credentials while still making them available to the application, but there is still desire to ensure that MySQL logs reflect the real users running queries.

Does anyone know of a way that I can restrict mysql -u <user> to force <user> to be the logged unix username? The database is hosed on AWS RDS so I don't have a lot of control over it, but I do have full control over the mysql binary on the connecting machine.

I'm happy to add more info, I'm just not sure what is relevant. Please ask questions and I'll update my own.

Is there any way to do something like wrap the binary to add logic to restrict the -u switch and call the actually mysql binary?

  • Why? Isn't the usual password protection of the mysql users enough? If you have proper passwords, successfully connecting with someone else's account becomes rather difficult – ilkkachu Dec 9 '17 at 21:39
  • The developers have access to the credentials that are used by the application. I understand that this is another problem to solve and I'm working on it. Even so, if it were possible, there would still be a desire by the InfoSec team to ensure that MySQL logs reflect the true users running queries. – Ryan Fisher Dec 9 '17 at 22:59
  • Do the developers also have access to the user account(s) that run the application? If yes, then they could bypass the system you're proposing, too. If no, then it should be simple to have a separate account for production use. Sure, you still have sysadmins to "worry" about, but there's no easy way to get around that. – ilkkachu Dec 10 '17 at 9:48
  • But in general, for connections that come over the network, there's not much to do to fix the connection to a user account on the client machine, the information just isn't there in the IP packets, and accounts on some remote system don't really even mean anything. Which is kinda why you have to do any identification by passwords/certificates/keys/whatever. Connections through Unix domains sockets can tell you the remote UID, but that only works within a single system, and I've no idea if Mysql supports using that information. – ilkkachu Dec 10 '17 at 9:51
2

MySQL Enterprise Edition supports PAM (Pluggable Authentication Modules).

This article describes how to set it up: https://dev.mysql.com/doc/refman/5.5/en/pam-pluggable-authentication.html

The disadvantage is that you

  • need the commercial version of MySQL
  • need access to the MySQL server‘s configuration files.

If you don‘t have that, there is not much you can do except writing a script that replicates the trusted Unix users in MySQL’s own user management. You won‘t be able to synchronize the passwords, though.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.