← Back to all products

Database Security Hardening

$39

Security configurations for PostgreSQL, MySQL, MongoDB: encryption, access control, audit logging, compliance.

📁 25 files
MarkdownShellPythonSQLPostgreSQL

📄 Product Preview

Try the interactive reader and demo tools below, or get the full product with all content unlocked.

📖 Interactive Reader (Free Preview) ⚙ Try Demo Tools 📦 Download Free Sample

📁 File Structure 25 files

database-security-hardening/ ├── LICENSE ├── README.md ├── config/ │ ├── my.cnf │ ├── pg_hba.conf │ └── postgresql.conf.ssl ├── docs/ │ ├── cis-mysql-checklist.md │ ├── cis-postgres-checklist.md │ ├── encryption-guide.md │ ├── secrets-management.md │ └── threat-model.md ├── free-sample.zip ├── guide/ │ ├── 01_who-this-is-for.md │ ├── 02_prerequisites.md │ ├── 03_file-by-file-guide.md │ └── 04_license.md ├── index.html ├── scripts/ │ ├── check_tls.sh │ ├── pg_privilege_audit.sql │ └── privilege_audit.py └── sql/ ├── mysql-audit-logging.sql ├── mysql-users-grants.sql ├── postgres-audit-logging.sql ├── postgres-encryption-pgcrypto.sql ├── postgres-roles-grants.sql └── postgres-row-level-security.sql

📖 Documentation Preview README excerpt

Database Security Hardening

A hands-on hardening kit for PostgreSQL and MySQL/MariaDB: least-privilege

roles, TLS and host-based authentication, audit logging, row-level security,

column encryption, secrets management, and CIS-style checklists you can actually

run. Everything here is copy-paste runnable SQL, real config snippets, and two

small tools — no agents, no SaaS, no external dependencies.

This kit exists because most "secure your database" advice stops at "use a strong

password." Real hardening is a stack of controls so that one mistake — a leaked

credential, a stolen disk, an injected query — stays contained instead of turning

into a breach. Each file targets a specific layer of that stack.

Who this is for

  • Backend engineers and DBAs standing up a new PostgreSQL/MySQL instance.
  • Teams preparing for a security review or SOC 2 / ISO 27001 control mapping.
  • Anyone who inherited a database where "the app connects as the superuser."

You should be comfortable running psql/mysql as an admin and editing server

config files. You do not need any paid tooling.

Contents


database-security-hardening/
├── README.md
├── LICENSE
├── sql/
│   ├── postgres-roles-grants.sql        # layered NOLOGIN groups + LOGIN roles, default privileges
│   ├── postgres-row-level-security.sql  # multi-tenant RLS with FORCE + WITH CHECK
│   ├── postgres-audit-logging.sql       # pgAudit + append-only row-history trigger
│   ├── postgres-encryption-pgcrypto.sql # AES-256 column encryption, HMAC lookup, bcrypt passwords
│   ├── mysql-users-grants.sql           # roles, host-pinned TLS accounts, resource limits
│   └── mysql-audit-logging.sql          # plugin notes + universal trigger-based trail
├── config/
│   ├── postgresql.conf.ssl              # TLS, SCRAM, logging, DoS guards
│   ├── pg_hba.conf                      # hostssl rules, cert auth, explicit deny
│   └── my.cnf                           # TLS, auth plugin, secure_file_priv, audit
├── scripts/
│   ├── privilege_audit.py               # offline grant auditor (stdlib only, has --demo)
│   ├── pg_privilege_audit.sql           # export queries that feed the auditor
│   └── check_tls.sh                     # verify a live endpoint's TLS + certificate
└── docs/
    ├── cis-postgres-checklist.md        # L1/L2 hardening checklist, PostgreSQL
    ├── cis-mysql-checklist.md           # L1/L2 hardening checklist, MySQL/MariaDB
    ├── threat-model.md                  # STRIDE breakdown + attacker walkthrough
    ├── secrets-management.md            # keep credentials out of code; rotate safely
    └── encryption-guide.md              # at-rest + in-transit, layer by layer

Prerequisites

  • PostgreSQL 13–16 or MySQL 8.0/8.4 / MariaDB 10.6+.

... continues with setup instructions, usage examples, and more.

📄 Code Sample .sh preview

scripts/check_tls.sh#!/usr/bin/env bash # ============================================================================= # check_tls.sh -- verify that a database endpoint enforces TLS and presents a # valid, strong certificate. Read-only: it connects, inspects, and reports. # # Requires: openssl (always), and optionally psql / mysql for the live auth- # rejection test. No credentials are needed for the certificate inspection. # # Usage: # ./check_tls.sh --engine postgres --host db01.example.com --port 5432 # ./check_tls.sh --engine mysql --host db01.example.com --port 3306 # # Exit codes: 0 = all checks passed, 1 = a check failed, 2 = usage/setup error. # ============================================================================= set -o errexit set -o nounset set -o pipefail ENGINE="" HOST="db01.example.com" PORT="" MIN_TLS="1.2" FAILURES=0 usage() { cat <<'USAGE' Usage: check_tls.sh --engine <postgres|mysql> --host <host> [--port <port>] [--min-tls <1.2|1.3>] Checks performed: 1. A TLS session can be established (STARTTLS for postgres, native for mysql). 2. The negotiated protocol is >= --min-tls. 3. The server certificate is currently valid (not expired / not-yet-valid). 4. The certificate has at least a 2048-bit RSA / 256-bit EC key. USAGE } log() { printf '[ check ] %s\n' "$1"; } pass() { printf '[ OK ] %s\n' "$1"; } fail() { printf '[ FAIL ] %s\n' "$1"; FAILURES=$((FAILURES + 1)); }
Buy Now — $39 Back to Products