Prevent copying from mysql data tables ?

[whiterussian]

Hi gurus!
Recently we had to move some of our databases to the clients site onto their linux server.
Can someone hint on how to prevent "the clients" from snatching our data and db schema? The drawback: they do own the machine - hence they do have a root password, therefore even if I change the unix permissions on the mysql directories - they are still open to the "root".
My guess is there is not much we can do, but if someone can suggest some kind of a "hook" or "id-stamp" that can be used - that would help a lot !.
Thanks in advance,
WR.

 

[wgcs]

Although your client has root access to the linux machine, that doesn't mean you have to give them "root" access to the MySql database(s).

I really don't have much experience yet about MySql, but I've been experimenting: I belive some of the table formats allow encryption, and I know you can enforce schema/data security through user rights.

Just embed the userid/pwd in your application where the customer can't access it, and don't give full rights to that userid/pwd, in case there is a way to intercept it by sniffing the tcp/ip connection.

 

[lgarner]

They may not have root access to MySQL, but if they have access to the file system they can simply copy the data files to another server. I think that as long as they can grant rights to a table, the table will be accessible.

 

[wgcs]

Right: "as long as they can grant rights to a table"

Keep them from getting these rights. Don't give the customer any UserID/Pwd to access the DB: Keep that info embedded inside your program.

 

[lgarner]

If you can copy the data files from one MySQL instance to another (to which you have root access), then you can access them.

If the customer wants access to the data, they can set up another server with MySQL and copy the application data directory (not the MySQL data dir) to the new server.

 

[wgcs]

Ok. I guess I was mistaken: I thought that each database had the list of users for it, in it....

 

[lgarner]

They're in the mysql database, in the db, tables_priv and columns_priv tables.

I notice that there's no "root" in mine, only in mysql.user, so I guess that root automatically trumps the lower privileges.

There's also a "func" and a "host" table, but I don't know what they do.

 

[whiterussian]

Hi guys,
Thank you for posting your comments. Indeed my situation is just as mr(mrs?)lgarner described: the customer owns the root password of the machine, therefore nothing can prevent him from copying the data directories of this mysql instance to another instance to view the structure and the data. I was hoping that someone can suggest some kind of a hook that will make the data unusable after it has been moved... like bounding to a specific IP or port.
Thanks again. WR.

 

[rrsub]

Another way to do it is to encrypt the data with a hidden "salt" key.

Even make it so that the key has to come from a PHP script from an outside site.

They see "efweIKLJE90932-:Jd" if they copy the db or view the rows.

...is displayed or you see with the key "This is my Data