打印本文 
关闭窗口 这是解决问题的根本之道。我们需要一种工具。许多安全机构和人员提出了不少对付这种攻击的方法。今天我们看一个不错的工具GreenSQL，可以说它是一个MySQL数据库防火墙，可以过滤SQL注入攻击。
它位于网站和MySQL数据库之间，可以决定哪些SQL语句可以执行，哪些不应当执行。再加上其Web界面，使得 用户可以通过浏览器来管理GreenSQL。GreenSQL的设计目的就是用作MySQL数据库的一个代理服务器。它不是将用户的请求直接连接到MySQL数据库，而是连接到GreenSQL。 GreenSQL将合法的SQL提交给MySQL数据库并返回结果。
如果GreenSQL检测到一条不属于白名单并包含恶意SQL的语句，它将阻止此SQL 并返回一个空结果，不与MySQL数据库发生联系。笔者完成此文时，Fedora、openSUSE、 Ubuntu 等Linux发行版本并没有包含GreenSQL。
在本文中，笔者将在一台64位的Fedora 9计 算机上从源代码安装greensql-fw 0.8.4。安装过程并没有使用自动化的工具，所以必须手动设置一些东西，如配置文件、系统用户、MySQL配置、日志文件、/etc/init.d等。 这些过程在install.txt文件中有明确说明，所以并不太费力。当然，通过执行脚本字典中的几个脚本外壳，你也可以完成安装的不 少内容。为编译应用程序，可以简单地执行“make”，如下所示：
$ tar xzf /.../greensql-fw-0.8.4.tar.gz $ cd greensql-fw-0.8.4/ $ make ... connection.hpp:29: error: field 'proxy_event' has incomplete type connection.hpp:30: error: field 'client_event' has incomplete type |
vi /usr/include/event.h ... #include |
$ cd src $ vi mysql/mysql_con.cpp ... // License: GPL v2 (http://www.gnu.org/licenses/gpl.html) // #include $ vi config.hpp ... #ifndef GREEN_SQL_CONFIG_HPP #define GREEN_SQL_CONFIG_HPP #include $ vi ../src/parser/expression.hpp ... #ifndef _SQL_EXPRESSION_HPP_ #define _SQL_EXPRESSION_HPP_ #include |
$ vi src/Makefile ... LIBS:=-L/usr/local/lib -L/usr/local/lib/mysql -L/usr/lib64/mysql -lmysqlclient -levent -lpcre greensql-fw: $(OBJS) ... $ make |
greensql-fw-0.8.4]# cd ./scripts/ # ./setup_user.sh done... # ./greensql-create-db.sh ----------------------------- ---------------- The following settings will be used: MySQL admin user: [root] MySQL admin password: [] MySQL server address: [127.0.0.1] GreenSQL configuration DB name: [greendb] DB user to create: [green] Password to set: [pwd] Do you want to change anything? [y/N] y MySQL admin user [root]: MySQL admin password []: XXxxXXxxXXxx-FIXME MySQL server address (you can use ip:port string) [127.0.0.1]: GreenSQL config db name [greendb]: GreenSQL DB user name [green]: greendb GreenSQL DB user password [pwd]: greendbpass --------------------------------------------- The following settings will be used: Do you want to change anything? [y/N] Creating MySQL database... Adding MySQL user... Creating MySQL tables... GreenSQL configuration file is not writable!!! Check that [database] section contains the following settings in /etc/greensql/greensql.conf [database] dbhost=127.0.0.1 dbname=greendb dbuser=greendb dbpass=greendbpass # dbport=3306 ... # ./setup_conf.sh done... # ./setup_log.sh done... # ./setup_binary.sh done... # vi /etc/greensql/greensql.conf ... [database] dbhost=127.0.0.1 dbname=greendb dbuser=greendb dbpass=greendbpass ... # chkconfig --add greensql service greensql does not support chkconfig # /etc/init.d/greensql start |
# mysql -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. mysql> GRANT ALL ON test.* TO ben@"%"; mysql> FLUSH PRIVILEGES; |
$ mysql --verbose -h 127.0.0.1 -P 3305 test mysql> create table foo ( id int ); -------------- create table foo ( id int ) -------------- Query OK, 0 rows affected (0.01 sec) mysql> insert into foo values ( 55 ); -------------- insert into foo values ( 55 ) -------------- ERROR 1146 (42S02): Table 'test.foo' doesn't exist $ mysql --verbose -h 127.0.0.1 -P 3306 test Welcome to the MySQL monitor. Commands end with ; or \g. mysql> create table foo ( id int ); -------------- create table foo ( id int ) -------------- Query OK, 0 rows affected (0.01 sec) mysql> insert into foo values ( 55 ); -------------- insert into foo values ( 55 ) -------------- Query OK, 1 row affected (0.00 sec) mysql> insert into foo values ( 131 ); -------------- insert into foo values ( 131 ) -------------- Query OK, 1 row affected (0.00 sec) mysql> select * from foo; -------------- select * from foo -------------- +------+ id +------+ 55 131 +------+ 2 rows in set (0.00 sec) |
$ mysql --verbose -h 127.0.0.1 -P 3305 test Welcome to the MySQL monitor. Commands end with ; or \g. mysql> select * from foo; -------------- select * from foo -------------- +------+ id +------+ 55 131 +------+ 2 rows in set (0.00 sec) mysql> drop table foo; -------------- drop table foo -------------- Query OK, 0 rows affected (0.00 sec) mysql> select * from foo; -------------- select * from foo -------------- +------+ id +------+ 55 131 +------+ 2 rows in set (0.01 sec) |
$ mysql --verbose -h 127.0.0.1 -P 3305 test mysql> delete from foo where 1=1; -------------- delete from foo where 1=1 -------------- Query OK, 2 rows affected (0.00 sec) mysql> select * from foo; -------------- select * from foo -------------- Empty set (0.00 sec) |
SQL_DEBUG: QUERY command[]: delete from foo where 1=1 SQL_DEBUG: AFTER NORM : delete from foo where ?=? SQL_DEBUG: RISK : 0 |
SQL_DEBUG: QUERY command[]: delete from foo where id=181 or 1=1 SQL_DEBUG: AFTER NORM : delete from foo where id=? or ?=? SQL_DEBUG: RISK : 0 SQL_DEBUG: QUERY command[]: delete from s where comment = 'whatever' or '1'='1' SQL_DEBUG: AFTER NORM : delete from s where comment = ? or ?=? SQL_DEBUG: RISK : 0 |
SQL_DEBUG: QUERY command[]: select * from folks where name='sam' or '1'='1' SQL_DEBUG: AFTER NORM : select * from folks where name=? or ?=? DEBUG: Query has 'or' token DEBUG: Variable comparison only SQL_DEBUG: RISK : 35 |
由于select语句中的SQL注入允许用户在没有口令的情况可以登录进入一个站点，让GreenSQL检查一下你的select未尝不是一个好主 意。不过,笔者希望GreenSQL的未来版本可以将保护扩展到delete语句,因为它可以清除整个数据表。
打印本文 关闭窗口