Attack Surface Reduction & Hardening Recipes

Database Security Hardening

Lock down configuration files, disable default administrative backdoors, and mandate end-to-end TLS encryption.

Filter by Engine:

postgresql • auth

PostgreSQL pg_hba.conf Hardening & Mandatory SCRAM-SHA-256 + TLS

critical

Deprecate legacy MD5 and insecure `trust` auth methods, enforcing SCRAM-SHA-256 encryption and mandatory TLS certificates.

Hatalı / Güvensiz Pratik:

# TEHLİKELİ: Tüm ağa şifresiz veya zayıf MD5 erişimi
host    all    all    0.0.0.0/0    trust
host    all    all    0.0.0.0/0    md5

Sertleştirilmiş / Güvenli Pratik:

# GÜVENLİ: Sadece TLS (hostssl), tanımlı subnet ve SCRAM-SHA-256
hostssl app_db  app_user 10.0.4.0/24  scram-sha-256
hostssl all     dba_team 10.0.1.0/24  scram-sha-256 clientcert=verify-full

Doğrulama / Test Sorgusu:

SELECT usename, client_addr, ssl, cipher FROM pg_stat_ssl JOIN pg_stat_activity USING (pid);

mysql • network

MySQL Attack Surface Reduction (local_infile=0 & bind-address)

critical

Disable client-side local file reads and restrict listening socket to internal private VPC subnets.

Hatalı / Güvensiz Pratik:

[mysqld]
bind-address = 0.0.0.0
local_infile = 1

Sertleştirilmiş / Güvenli Pratik:

[mysqld]
bind-address = 10.0.2.15
local_infile = 0
skip_show_database = 1
require_secure_transport = ON

Doğrulama / Test Sorgusu:

SHOW VARIABLES LIKE 'local_infile';
SHOW VARIABLES LIKE 'require_secure_transport';

sql-server • privilege

SQL Server xp_cmdshell & CLR Attack Surface Hardening

critical

Disable OS shell execution via xp_cmdshell and rename/disable the builtin `sa` administrator account.

Hatalı / Güvensiz Pratik:

-- TEHLİKELİ: İşletim sistemi erişimi açık
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

Sertleştirilmiş / Güvenli Pratik:

-- GÜVENLİ: xp_cmdshell ve CLR kapalı
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;
ALTER LOGIN [sa] DISABLE;
ALTER LOGIN [sa] WITH NAME = [sys_admin_disabled];

Doğrulama / Test Sorgusu:

SELECT name, is_disabled FROM sys.server_principals WHERE sid = 0x01;

sql-server • encryption

SQL Server Transparent Data Encryption (TDE) at Rest

critical

Encrypts data and log files using AES-256 to ensure stolen backups cannot be restored on unauthorized servers.

Hatalı / Güvensiz Pratik:

-- TEHLİKELİ: Şifresiz düz metin veritabanı
SELECT name, is_encrypted FROM sys.databases WHERE is_encrypted = 0;

Sertleştirilmiş / Güvenli Pratik:

-- GÜVENLİ: Master Key + Certificate + TDE AES_256
USE master;
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'ComplexMasterKeyPass!2026';
CREATE CERTIFICATE TDE_Cert WITH SUBJECT = 'TDE Certificate 2026';
USE production_db;
CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_256 ENCRYPTION BY SERVER CERTIFICATE TDE_Cert;
ALTER DATABASE production_db SET ENCRYPTION ON;

Doğrulama / Test Sorgusu:

SELECT db_name(database_id), encryption_state FROM sys.dm_database_encryption_keys;