mysql添加mcafee 审计插件

插件源码地址
https://github.com/mcafee/mysql-audit
插件安装方法
https://github.com/mcafee/mysql-audit/wiki/Installation
插件下载地址
https://bintray.com/mcafee/mysql-audit-plugin/release/1.0.9-585

1、查看mysql插件存放目录
mysql> SHOW GLOBAL VARIABLES LIKE ‘plugin_dir‘;
+---------------+-----------------------------------+
| Variable_name | Value |
+---------------+-----------------------------------+
| plugin_dir | /usr/local/mysql/lib/plugin/ |
+---------------+-----------------------------------+
1 row in set (0.01 sec)

2、复制libaudit_plugin.so 至 mysql插件目录
mv libaudit_plugin.so /usr/local/mysql/lib/plugin/
chmod a+x /usr/local/mysql/lib/plugin/*
chown mysql:mysql /usr/local/mysql/lib/plugin/*

3、安装插件
初使使用在线安装，但是安装失败
mysql> INSTALL PLUGIN AUDIT SONAME ‘libaudit_plugin.so‘;
ERROR 1524 (HY000): Plugin ‘AUDIT‘ is not loaded

然后使用修改配置，然后重启数据库，官方推荐使用修改配置方式安装。
Note: On production systems, McAfee recommends using the plugin-load option for installing the audit plugin.

修改my.cnf文件，添加加载审计插件代码
plugin-load=AUDIT=libaudit_plugin.so
audit_json_file=on
audit_force_record_logins=on
audit_json_file_sync=1

重启数据库
/etc/init.d/mysql.server restart

4、查看插件状态
mysql> show plugins;
+----------------------------+----------+--------------------+--------------------+---------+
| Name | Status | Type | Library | License |
+----------------------------+----------+--------------------+--------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| mysql_old_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| sha256_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| FEDERATED | DISABLED | STORAGE ENGINE | NULL | GPL |
| PERFORMANCE_SCHEMA | ACTIVE | STORAGE ENGINE | NULL | GPL |
| BLACKHOLE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| InnoDB | ACTIVE | STORAGE ENGINE | NULL | GPL |
| INNODB_TRX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCKS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCK_WAITS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_PER_INDEX_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE_LRU | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_POOL_STATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_METRICS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DEFAULT_STOPWORD | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_BEING_DELETED | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_CONFIG | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_CACHE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_FT_INDEX_TABLE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESTATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_INDEXES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_COLUMNS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FIELDS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_FOREIGN_COLS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_TABLESPACES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_SYS_DATAFILES | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| ARCHIVE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| AUDIT | ACTIVE | AUDIT | libaudit_plugin.so | GPL |
+----------------------------+----------+--------------------+--------------------+---------+
43 rows in set (0.00 sec)

5、查看插件的配置参数
mysql> show global VARIABLES like ‘%audit%‘;
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Variable_name | Value |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| audit_checksum | |
| audit_delay_cmds | |
| audit_delay_ms | 0 |
| audit_force_record_logins | ON |
| audit_header_msg | ON |
| audit_json_file | ON |
| audit_json_file_bufsize | 1 |
| audit_json_file_flush | OFF |
| audit_json_file_retry | 60 |
| audit_json_file_sync | 1 |
| audit_json_log_file | mysql-audit.json |
| audit_json_socket | OFF |
| audit_json_socket_name | /tmp/mysql.audit__data_mysql_3306_datadir_mysqldata_3306 |
| audit_json_socket_retry | 10 |
| audit_offsets | |
| audit_offsets_by_version | ON |
| audit_password_masking_cmds | CREATE_USER,GRANT,SET_OPTION,SLAVE_START,CREATE_SERVER,ALTER_SERVER,CHANGE_MASTER |
| audit_password_masking_regex | identified(?:/\*.*?\*/|\s)*?by(?:/\*.*?\*/|\s)*?(?:password)?(?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"]|password(?:/\*.*?\*/|\s)*?\((?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"](?:/\*.*?\*/|\s)*?\)|password(?:/\*.*?\*/|\s)*?(?:for(?:/\*.*?\*/|\s)*?\S+?)?(?:/\*.*?\*/|\s)*?=(?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"]|password(?:/\*.*?\*/|\s)*?[‘|"](?<psw>.*?)(?<!\\)[‘|"] |
| audit_record_cmds | |
| audit_record_objs | |
| audit_uninstall_plugin | OFF |
| audit_validate_checksum | ON |
| audit_validate_offsets_extended | ON |
| audit_whitelist_cmds | BEGIN,COMMIT |
| audit_whitelist_users | |
+---------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
25 rows in set (0.01 sec)

6、验证审计
[[email protected]_166_132 mysqldata]# tailf /data/mysql/mysql-audit.json
{"msg-type":"activity","date":"1480659848340","thread-id":"4","query-id":"12","user":"root","priv_user":"root","host":"","ip":"127.0.0.1","cmd":"show_variables","objects":[{"db":"information_schema","name":"/tmp/#sql_6a75_0","obj_type":"TABLE"}],"query":"SHOW GLOBAL VARIABLES LIKE ‘plugin_dir‘"}
{"msg-type":"activity","date":"1480659883722","thread-id":"4","query-id":"13","user":"root","priv_user":"root","host":"","ip":"127.0.0.1","cmd":"show_plugins","objects":[{"db":"information_schema","name":"/tmp/#sql_6a75_0","obj_type":"TABLE"}],"query":"show plugins"}

7、关闭审计

mysql> set GLOBAL audit_json_file=off ;
Query OK, 0 rows affected (0.01 sec)

8、禁用插件

mysql> UNINSTALL PLUGIN AUDIT;
ERROR 1148 (42000): Uninstall AUDIT plugin disabled

在线禁用失败，采取修改配置文件，重启方式修改。

时间： 2024-10-01 04:15:20

mysql添加mcafee 审计插件的相关文章

MySQL audit—SQL审计插件

自从MySQL5.6出现以来开始对json的支持后,使得在MySQL上增加了一些新特性,为此这一点让MySQL增加了一些新的插件支持,在这里就说一说MySQL的SQL审计插件,SQL审计插件并不是MySQL官方的,它是由macfee公司基于percona开发的,所以,在添加SQL审计的插件功能时需要去下载对应版本的MySQL audit插件(支持MariaDB),至于MySQL的插件安装比较简单,记得以前有说过MySQL的半同步复制功能时,其中的半同步复制也是插件,需要的可以参看:http://

MySQL之MariaDB启用审计插件

对于MySQL Percona MariaDB三家都有自己的审计插件,但是呢,MySQL的审计插件是只有企业版才有的,同时也有很多第三方的的MySQL的审计插件,而Percona和MariaDB都是GPL的审计插件 首先看一下mariaDB 的审计插件 [[email protected]_Aolens_01 /usr/local/mysql]# mysql -uroot -p2aa263a42dd248 Welcome to the MariaDB monitor.  Commands end

MySQL Percona server 5.5 安装审计插件

近期,公司要求对MySQL 数据库上操作进行审计:通过了解MySQL 官方企业版(付费版)本中集成了audit_log审计插件,但是社区开源版本中并不包含该插件,也没提供下载.进一步了解 MariaDB 有一个名为server_audit.so审计插件,据传以前是可以独立下载的.但是我在官网没找到下载链接,索性下载一个MariaDB 5.5.50 的二进制安装包,解压后从中捞一个 server_audit.so 文件, 1.登录数据库,查看plugin_dir目录mysql> SHOW GLOB

审计插件

通过审计插件可以记录服务器活动,记录谁连接到服务器,运行了什么查询,访问了哪些表,能存储到日志文件或发送到本地syslogd守护进程. 一.mariadb mariadb的审计插件能工作在mariadb.mysql和percona server.拷贝到server_audit.so到适当的目录,然后安装插件: [email protected][(none)] 21:52:32>INSTALL PLUGIN server_audit SONAME 'server_audit'; Query OK

CentOS 7.2 mysql-5.7.17 审计插件安装、开启与设定

最近因为一些事情的发生,出现了好端端的页面,变成了空页面.转头开发同事就来质问我,是不是我动了什么,后来经过调查发现,是平台运营的同事误删资料导致的. 所以如果运维或者开发部门有很多人都分配了数据库的增删改之类的操作权限的话,某一天哪个表或者字段丢失了都无法找到是谁干的,所以这个锅只能运维来背了.因此很有必要把数据库的操作记录保存下来,但是代价就是服务器的效能就会变差一些了,但为了安全起见,还是建议开启的. 在一些操作限制中,难免会有人质疑具有super权限的用户做了什么动作,所以还是把root

roundcute 添加修改密码插件

添加修改密码插件 现打开main.inc.php 文件,搜索“$rcmail_config['plugins']”,找到: // List of active plugins (in plugins/ directory) $rcmail_config['plugins'] = array(); 这里我想添加修改密码功能,修改代码如下: // List of active plugins (in plugins/ directory) $rcmail_config['plugins'] = ar

Mysql添加用户错误:ERROR 1364 (HY000): Field &#39;ssl_cipher&#39; doesn&#39;t have a default value解决方法

添加用户 insert into mysql.user(Host,User,Password) values("localhost","test",password("1234")); 报以下的错误 ERROR 1364 (HY000): Field 'ssl_cipher' doesn't have a default value错误 mysql5.1以上版本,我是在5.6版本上操作的. 错语原因: mysql用户表的中某些字段不能为空,没有默

bootstrap设计网站中添加代码高亮插件

这款插件的名字叫做google-code-prettify 使用该插件之前的效果: 使用插件之后的效果: 接下来说步骤: (1)下载两个文件 http://codecloud.sinaapp.com/google-code-prettify/prettify.css http://codecloud.sinaapp.com/google-code-prettify/prettify.js (2)在head中引入这两个文件 <link href="google-code-prettify/p

mysql 添加用户

MySQL 添加用户 使用root用户登录:#mysql -uroot -p #密码为空 添加用户:# GRANT USAGE ON *.* TO 'cloud'@'localhost' IDENTIFIED BY 'cloud' WITH GRANT OPTION; 使用cloud用户登录:#mysql -ucloud -pcloud