# mysql_secure_installation
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.
Enter current password for root (enter for none):
OK, successfully used password, moving on...
Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.
You already have your root account protected, so you can safely answer 'n'.
Switch to unix_socket authentication [Y/n] y
Enabled successfully!
Reloading privilege tables..
... Success!
You already have your root account protected, so you can safely answer 'n'.
Change the root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
... Success!
By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.
Remove anonymous users? [Y/n] y
... Success!
Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] y
... Success!
By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.
Remove test database and access to it? [Y/n] y
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!
Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.
Reload privilege tables now? [Y/n] y
... Success!
Cleaning up...
All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.
Thanks for using MariaDB!
ipam用DBユーザ作成。
# mysql -u root -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 13
Server version: 10.5.16-MariaDB MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> create database phpipam;
Query OK, 1 row affected (0.000 sec)
MariaDB [(none)]> GRANT ALL on phpipam.* to phpipam@localhost identified by 'PASSWORD';
Query OK, 0 rows affected (0.050 sec)
MariaDB [(none)]> exit
Bye
# vi /etc/nginx/conf.d/php-fpm.conf
# PHP-FPM FastCGI server
# network or unix domain socket configuration
upstream php-fpm {
server unix:/var/run/php-fpm/www.sock;
}
radius server FreeRadius
address ipv4 <radiusのIP> auth-port 1812 acct-port 1813
key secret-key
!
aaa new-model
!
!
aaa group server radius PPPoE
server name FreeRadius
ip radius source-interface GigabitEthernet0/4
!
aaa authentication ppp default group PPPoE
aaa authorization network default group PPPoE
aaa accounting network default start-stop group PPPoE
!
bba-group pppoe FLETS
virtual-template 1
!
interface Loopback1
ip address 172.17.1.1 255.255.255.0
!
interface GigabitEthernet1 # RADIUSサーバと通信するIF
ip address 192.168.1.3 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet3 # PPPoE接続用IF
no ip address
duplex auto
speed auto
pppoe enable group FLETS
!
interface Virtual-Template1
mtu 1454
ip unnumbered Loopback1
ppp authentication chap
!
PPPoEクライアント設定
IOS 15.x系
interface GigabitEthernet0/0
no ip address
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface GigabitEthernet0/1
ip address 10.10.10.1 255.255.255.248
!
interface Dialer0
ip unnumbered GigabitEthernet0/1
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname radius-user
ppp chap password 0 rad-secret
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
dialer-list 1 protocol ip permit
set interfaces ge-0/0/0 unit 0 encapsulation ppp-over-ether set interfaces ge-0/0/1 unit 0 family inet address 10.10.10.1/29 set interfaces fxp0 unit 0 set interfaces pp0 unit 1 ppp-options chap default-chap-secret "$9$eZBMxdbwgZGiN-kP5Q9CuO1Ervx7V2oG" set interfaces pp0 unit 1 ppp-options chap local-name radius-user set interfaces pp0 unit 1 ppp-options chap passive set interfaces pp0 unit 1 pppoe-options underlying-interface ge-0/0/0.0 set interfaces pp0 unit 1 pppoe-options auto-reconnect 10 set interfaces pp0 unit 1 pppoe-options client set interfaces pp0 unit 1 family inet unnumbered-address ge-0/0/1.0 set routing-options static route 0.0.0.0/0 next-hop pp0.1
Router(config)#enable secret ?
0 Specifies an UNENCRYPTED password will follow
5 Specifies a MD5 HASHED secret will follow
8 Specifies a PBKDF2 HASHED secret will follow
9 Specifies a SCRYPT HASHED secret will follow
<0-9> Encryption types not explicitly specified
LINE The UNENCRYPTED (cleartext) 'enable' secret
level Set exec level password
Router(config)#enable algorithm-type ?
md5 Encode the password using the MD5 algorithm
scrypt Encode the password using the SCRYPT hashing algorithm
sha256 Encode the password using the PBKDF2 hashing algorithm
Type5(MD5)
MD5の場合，opensslコマンドで対応できそうだ。オプションは-1がMD5。
$ openssl passwd --help
Usage: passwd [options]
Valid options are:
-help Display this summary
-in infile Read passwords from file
-noverify Never verify when reading password from terminal
-quiet No warnings
-table Format output as table
-reverse Switch table columns
-salt val Use provided salt
-stdin Read passwords from stdin
-6 SHA512-based password algorithm
-5 SHA256-based password algorithm
-apr1 MD5-based password algorithm, Apache variant
-1 MD5-based password algorithm
-aixmd5 AIX MD5-based password algorithm
-crypt Standard Unix password algorithm (default)
-rand val Load the file(s) into the random number generator
-writerand outfile Write random data to the specified file
Router(config)#enable secret 5 $1$.cR/0KTx$pPUO/YlCknfEryhGL8vZ7/
ERROR: The secret you entered is not a valid encrypted secret.
To enter an UNENCRYPTED secret, do not specify type 5 encryption.
When you properly enter an UNENCRYPTED secret, it will be encrypted.
Router(config)#enable secret 5 $1$tCLN$fofh2RhTlDmwzXeGUh7x4.
WARNING: Command has been added to the configuration using a type 5 password. However, type 5 passwords will soon be deprecated. Migrate to a supported password type
Router(config)#
*May 11 06:39:25.460: %AAAA-4-CLI_DEPRECATED: WARNING: Command has been added to the configuration using a type 5 password. However, type 5 passwords will soon be deprecated. Migrate to a supported password type
Type 8 passwords are what Type 4 was meant to be, an upgraded Type 5! Type 8 is hashed using PBKDF2, SHA-256, 80-bit salt, 20,000 iterations. While this is good, it is still vulnerable to brute-forcing since AES is easy to implement in (GPU) graphics cards. I have not proven it but I believe it is possible that the popular tool HashCat is able to decrypt these. In the running config standard Type 8 start with $8$.
Select a hashing algorithm:
[1] Type 5 (MD5)
[2] Type 7 (XOR Cipher)
[3] Type 8 (PBKDF2-HMAC-SHA256)
[4] Type 9 (Scrypt)
[5] Exit
Your selection: 4
Enter a Plain Text Password to convert: password
Your Cisco type 9 password is: $9$KvAkztzB8xe7Am$n3st6bOSv2hzH7qTG/9RHUInJ0DlbSmtTqOHOtn99UM
