CODEWITHSUNDEEP
mysqlmysql-workbench
newbie
newbie

Reputation: 1217

Is there a way to keep track of the calls being done in mysql server by a web app?

I'm finishing a system at work that makes calls to mysql server. Those calls' arguments reveal information that I need to keep private, like vote(idUser, idCandidate). There's no information in the db that relates those two of course, nor in "the visible part" of the back end, but even though I think this can't be done, I wanted to make sure that it is impossible to trace this sort of calls, with a log or something (calls that were made, or calls being made at the moment), as it is impossible in most languages, unless you specifically "debug" in a certain way, while the system is in production and being used. I hope the questions is clear enough. Thanks.

Upvotes: 0

Views: 85

Answers (1)

LSerni
LSerni

Reputation: 57408

How do I log thee? Let me count the ways.

  • MySQL query log. I can enable this per-session and send everything to a log file.
  • I can set up a slave server and have insertions sent to me by the master. This is a significant intervention and would leave a wide trace.
  • On the server, unbeknownst to either Web app and MySQL log, I can intercept communications between the two. I need administrative access to the machine, of course.
  • On the server, again with administrative access, I can both log the query calls and inject a logging instrumentation into the SQL interface (the legitimate one is the MySQL Audit Plugin, but there are several alternatives, developed for various purposes by developers over the years)

What can you do? You can have the applications use a secure protocol, just for starters.

Then, you need to secure your machine so that administrator tricks do not work, and even if the logs are activated, nobody can read them and you can be advised of any new and modified file to delete it promptly.

Upvotes: 1

Related Questions