基于kali2020环境，熟悉数据库服务的部署及基本验证方法及访问数据库
1.1 问题
本例要求基于kali2020环境，熟悉数据库服务的部署及基本验证方法，完成下列任务：
1）在kali2020上启用mysql服务，并设置开机自启
2）完成初始安全设置，将管理密码设为1234
3）使用 mysqladmin 更改管理密码，设置为 pwd@123
4）使用 mysql 验证无密码登录被拒绝
1.2 步骤
实现此案例需要按照如下步骤进行。
步骤一：在kali2020上启用mysql服务，并设置开机自启
1）启动mariadb数据库服务
root@kali:~# systemctl start mariadb
root@kali:~#
2）查看mariadb服务状态，确保激活标记为running
root@kali:~# systemctl status mariadb
● mariadb.service - MariaDB 10.3.20 database server
Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; vendor preset: disabled)
Active: active (running) since Thu 2020-03-19 01:34:38 CST; 1min 50s ago //正在运行
Docs: man:mysqld(8)
https://mariadb.com/kb/en/library/systemd/
Process: 2880 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d /var/run/mysqld (code=exited, status=0/SUCC>
Process: 2881 ExecStartPre=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SUC>
Process: 2883 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] && VAR= || VAR=`/usr/bin/galera_recovery>
Process: 2962 ExecStartPost=/bin/sh -c systemctl unset-environment _WSREP_START_POSITION (code=exited, status=0/SU>
Process: 2964 ExecStartPost=/etc/mysql/debian-start (code=exited, status=0/SUCCESS)
Main PID: 2931 (mysqld)
Status: "Taking your SQL requests now..."
Tasks: 31 (limit: 2309)
Memory: 73.5M
CGroup: /system.slice/mariadb.service
└─2931 /usr/sbin/mysqld
3月 19 01:34:37 kali systemd[1]: Starting MariaDB 10.3.20 database server...
3月 19 01:34:37 kali mysqld[2931]: 2020-03-19 1:34:37 0 [Note] /usr/sbin/mysqld (mysqld 10.3.20-MariaDB-1) starting a>
3月 19 01:34:38 kali systemd[1]: Started MariaDB 10.3.20 database server.
3月 19 01:34:38 kali /etc/mysql/debian-start[2966]: Upgrading MySQL tables if necessary.
3月 19 01:34:38 kali /etc/mysql/debian-start[2969]: /usr/bin/mysql_upgrade: the '--basedir' option is always ignored
3月 19 01:34:38 kali /etc/mysql/debian-start[2969]: Looking for 'mysql' as: /usr/bin/mysql
3月 19 01:34:38 kali /etc/mysql/debian-start[2969]: Looking for 'mysqlcheck' as: /usr/bin/mysqlcheck
3月 19 01:34:38 kali /etc/mysql/debian-start[2969]: This installation of MySQL is already upgraded to 10.3.20-MariaDB,>
3月 19 01:34:38 kali /etc/mysql/debian-start[2977]: Checking for insecure root accounts.
3月 19 01:34:38 kali /etc/mysql/debian-start[2981]: Triggering myisam-recover for all MyISAM tables and aria-recover f>
lines 1-27/27 (END) //按 q 键返回命令行
root@kali:~#
3）设置以后每次开机自动启动mariadb服务
root@kali:~# systemctl enable mariadb //标记开机自启
Created symlink /etc/systemd/system/mysql.service → /lib/systemd/system/mariadb.service.
Created symlink /etc/systemd/system/mysqld.service → /lib/systemd/system/mariadb.service.
Created symlink /etc/systemd/system/multi-user.target.wants/mariadb.service → /lib/systemd/system/mariadb.service.
root@kali:~# systemctl is-enabled mariadb //检查设置结果
enabled
4）测试快速访问
默认情况下，只要maridb服务已经运行，执行mysql命令无需密码即可连接。
root@kali:~# mysql //连接本机数据库系统
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 36
Server version: 10.3.20-MariaDB-1 Debian buildd-unstable
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> //连接成功
MariaDB [(none)]> quit //退出（返回命令行）
Bye
root@kali:~#
步骤二：完成初始安全设置，将管理密码设为1234
执行mysql_secure_installation命令，可以针对默认的mariadb数据库执行一系列安全初始化设置，包括设置密码、禁止匿名登录等等。
root@kali:~# mysql_secure_installation
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.
Enter current password for root (enter for none): //提供原密码（默认没有）
OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.
Set root password? [Y/n] y //输入y表示要设置新密码
New password: //输入新密码，比如1234
Re-enter new password: //重复一次新密码
Password updated successfully!
Reloading privilege tables..
... Success!
By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.
Remove anonymous users? [Y/n] //删除匿名数据库用户
... Success!
Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] //禁止root用户远程登录
... Success!
By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.
Remove test database and access to it? [Y/n] //删除test库
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!
Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.
Reload privilege tables now? [Y/n] //重新加载数据库权限表
... Success!
Cleaning up...
All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.
Thanks for using MariaDB!
root@kali:~#
步骤三：使用 mysql 验证无密码登录会被拒绝
当数据库系统要求用户名、密码，但是mysql连接未提供，或者提供的信息不对时，就会被拒绝（Access denied）。
root@kali:~# mysql
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)
root@kali:~#
步骤四：使用 mysqladmin 更改管理密码，设置为 pwd@123
实际工作中，1234这样的密码肯定是非常不安全的，特别是对于数据库系统来说。
因此一方面密码设置应该足够复杂，另一方面最好定期使用mysqladmin更换密码。
root@kali:~# mysqladmin -uroot -p1234 password 'pwd@123'
root@kali:~#