mysql best seucrity practices for permitting --local-infile to allow LOAD DATA LOCAL INFILE

Viewed 15

Trying to use LOAD DATA LOCAL INFILE to import a csv file revealed the this command is not allowed with this MySQL version error.

So upon further reading I learn that SET GLOBAL --local-infile=1 can only be set if the mysql account is ROOT or setting it in the my.conf file (and restart mysql). For security purposes, my script that needs to import the CSV file is using a non-root mysql admin account. In fact all of my public facing scripts use a non-root admin account to open up mysql sessions. Thus with out a root account, it doesn't look like I can set it on the fly and then disable when the script is done.

Next option is to set it at the server level in my my.conf file and restart mysql. But once I enable --local-infile=1 on the server I have then exposed it to security issues. After that all a client needs to do mysql -u user -p password dbName --local-infile=1 for that session and then that client now has access. This def does not seem ideal...or am I wrong about this assumption?

The other option is then using LOAD DATA INFILE which apparently uses the root file systems /tmp directory to save files to and for mysql LOAD DATA INFILE to read from. But that then requires both the /tmp directory being globally available AND/OR a system admin having access to that directory. Unless I am root on the linux box, I can't write to that directory without opening it up globally. Opening up /tmp globally is itself a security issue.

Ideally, using a mysql non-root account, how can I enable --local-infile=1 temporarily to run my script and then disable it when done? Or...what is another method I can consider that would achieve the same result?

0 Answers
Related