Kyle Hamilton wrote:
First: I have suggested such, in the message where I stated that many
hotels don't allow connections on port 3306 (which is MySQL's standard
data port). Create a proxy that sits on a webserver, using XML-RPC to
accept requests from the client. Perform whatever logic checking you
need there, and log every access.
Second: You can manipulate the database, but can you look back and
audit the manipulations you make to the database? You stated that you
don't think that you have the ability at the MySQL layer to see what
the clients are doing, much less what they have done.
Third: If you're the security consultant, why should I have to provide
free consulting for you to be able to profit from? There's a LOT of
books on the topic, and I would recommend that you read them.
Basically, at every step, do whatever you have to to mitigate the
damage that an attacker can do. Don't allow DELETE access from
critical tables to your users, add a boolean column that states
whether the record has been deleted, and only after you have ensured
that those records are backed up should you purge them (which can be
done from a user account which does have DELETE access: 'delete from
table where (backedup == true and deleted == true)'.
You must model the security threats against your database, and find
ways to mitigate them and identify people responsible for attempts to
breach security so that their ability to threaten your database can be
removed. Without details (and money for my time :P) I can't perform
this analysis for you.
Thanks for your suggestions about protecting the database itself. I do
appreciate them and I am not asking for you or anyone to offer free
consulting for me. We will look at things we can do on the database
server side to protect the database using some of your suggestions.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager majord...@openssl.org
