Skip to Main Content
Linux Server Security, Second Edition
book

Linux Server Security, Second Edition

by Michael D. Bauer
January 2005
Intermediate to advanced content levelIntermediate to advanced
544 pages
23h 44m
English
O'Reilly Media, Inc.
Content preview from Linux Server Security, Second Edition
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Database Operation
|
247
Many public MySQL-based sites such as slashdot.org have migrated from MyISAM
to InnoDB.
Loading Datales
If you have FILE privileges, you can bulk load data from a flat file to a MySQL table.
This has obvious security implications.
The SQL LOAD DATA command reads a flat file on the database machine into a
MySQL table. This could be used to load /etc/passwd into a table, then read it with a
SQL SELECT statement. Since end users should not be stuffing files into tables, it’s
best to restrict this to administrative accounts. For example, if you need to load a flat
file into a particular table every day, create a MySQL account for that purpose and
grant it load privileges:
GRANT FILE ON database.table TO user@host identified by "password"
The SQL LOAD DATA LOCAL command allows the database server to read files
from the client. This permits an evil server to grab any file from the database client,
or an evil client to upload a file of its choice.
Recent versions of MySQL (3.23.49+ and 4.0.2+) are compiled to include an explicit
--enable-local-infile option for backward compatibility. To disable this ability
completely, they can be compiled without this option. Local loads can also be dis-
abled at runtime by starting mysqld with the
--local-infile=0 option.
Writing Data ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Linux: Powerful Server Administration

Linux: Powerful Server Administration

Uday Sawant, Oliver Pelz, Jonathan Hobson, William Leemans
Linux Server Hacks

Linux Server Hacks

Rob Flickenger
Linux Server Hacks, Volume Two

Linux Server Hacks, Volume Two

William von Hagen, Brian K. Jones

Publisher Resources

ISBN: 0596006705Supplemental ContentCatalog PageErrata