If you already have MySQL installed from the yum repositories, then you won’t be able to follow this guide as your MySQL version is too old. Please see\u00a0[here]<\/a>\u00a0which may be able to help you (untested).<\/p>\n Fresh install of\u00a0CentOS-6.3-x86_64-minimal<\/a>\u00a0with the latest updates\u00a0 I have also disabled SELINUX. Please see\u00a0[here]<\/a>\u00a0for a guide.<\/p>\n Nb. You can check for the latest EPEL repository from\u00a0http:\/\/mirror.datacenter.by\/pub\/fedoraproject.org\/epel\/6\/x86_64\/repoview\/epel-release.html<\/a><\/p>\n Then you need to enable the REMI repository<\/p>\n I used\u00a0nano<\/strong>\u00a0as the text editor, but you can just as easily use\u00a0vi<\/strong>\u00a0if you are familiar with it.<\/p>\n Make sure you add any other rules you are using which aren’t listed here.<\/em><\/p>\n Example of what to fill in but input your own answers.<\/p>\n You can test the certificate is ok by typing<\/p>\n At the time of writing, the version of MySQL in the CentOS yum repositories was version 5.1 which is near\u00a0EOL<\/abbr>\u00a0so don’t use it unless you have to.<\/p>\n If you would prefer to have the latest version of MySQL, then see the note below instead<\/p>\n Note:<\/strong>\u00a0To install the latest version of MySQL, you can get the latest version of MySQL from\u00a0http:\/\/dev.mysql.com\/downloads\/mysql\/#downloads<\/a>(select Red Hat Linux 6) and note you need Server, Client and Compatibility Libraries<\/p>\n The installation creates a random root password which you can see in\u00a0\/root\/.mysql_secret<\/strong><\/p>\n Take a look at the log file to make sure no start-up errors<\/p>\n Now grab the pre-set password and login<\/p>\n Change\u00a0mypassword<\/strong>\u00a0to your own password. The password should be at least 10 characters. You can generate a password\u00a0[here]<\/a>.<\/p>\n You can get the latest version from\u00a0http:\/\/www.phpmyadmin.net\/home_page\/downloads.php<\/a><\/p>\n The password can be up to 46 characters. You can generate a password\u00a0[here]<\/a>.<\/p>\nEnvironment<\/h3>\n
yum update -y<\/code><\/p>\n\n
# uname -sro\nLinux 2.6.32-279.22.1.el6.x86_64 GNU\/Linux<\/pre>\n<\/blockquote>\n
Prerequisites<\/h3>\n
Additional Repositories<\/h4>\n
\n
\n
[remi]\nenabled=1<\/pre>\n<\/blockquote>\n
Additional Packages<\/h4>\n
\n
Configure Firewall<\/h4>\n
\n
*filter\n:INPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n-A INPUT -p icmp -j ACCEPT\n-A INPUT -i lo -j ACCEPT\n-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT\n\n-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT\n-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT\n\n# Uncomment the following line to allow direct remote access to your mysql server, \n# changing -s 192.168.0.0\/16 to your own network or remove it to allow access from anywhere\n# This has serious security implications so only do it if you know what you're doing\n#-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT -s 192.168.0.0\/16\n\n-A INPUT -j REJECT --reject-with icmp-host-prohibited\n-A FORWARD -j REJECT --reject-with icmp-host-prohibited\nCOMMIT<\/pre>\n<\/blockquote>\n
Create SSL Certificates<\/h4>\n
\n
\nopenssl req -new -nodes -x509 -keyout \/etc\/ssl\/certs\/ca-cert.pem -out \/etc\/ssl\/certs\/ca-cert.pem -days 3650
\nopenssl req -new -nodes -days 3650 -keyout \/etc\/ssl\/certs\/mysql\/server-key.pem -out \/etc\/ssl\/certs\/mysql\/server-req.pem openssl rsa -in \/etc\/ssl\/certs\/mysql\/server-key.pem -out \/etc\/ssl\/certs\/mysql\/server-key.pem openssl x509 -req -in \/etc\/ssl\/certs\/mysql\/server-req.pem -CA \/etc\/ssl\/certs\/ca-cert.pem -CAcreateserial -days 3650 -out \/etc\/ssl\/certs\/mysql\/server-cert.pem
\nopenssl req -new -nodes -days 3650 -keyout \/etc\/ssl\/certs\/mysql\/client-key.pem -out \/etc\/ssl\/certs\/mysql\/client-req.pem openssl rsa -in \/etc\/ssl\/certs\/mysql\/client-key.pem -out \/etc\/ssl\/certs\/mysql\/client-key.pem openssl x509 -req -in \/etc\/ssl\/certs\/mysql\/client-req.pem -CA \/etc\/ssl\/certs\/ca-cert.pem -CAcreateserial -days 3650 -out \/etc\/ssl\/certs\/mysql\/client-cert.pem<\/div>\n<\/blockquote>\nCountry Name (2 letter code)<\/a> [XX]:IM\nState or Province Name (full name) []:Isle of Man\nLocality Name (eg, city) [Default City]:Colby\nOrganization Name (eg, company) [Default Company Ltd]:ITManx Ltd\nOrganizational Unit Name (eg, section) []:ICT\nCommon Name (eg, your name or your server's hostname) []:secure.itmanx.com\nEmail Address []:support@itmanx.com\n\n* You will get asked the following on the server and client certificates created. Leave these blank!\nA challenge password []:\nAn optional company name []:<\/pre>\n
\n
\/etc\/ssl\/certs\/mysql\/server-cert.pem: OK\n\/etc\/ssl\/certs\/mysql\/client-cert.pem: OK<\/pre>\n<\/blockquote>\n
Install<\/h3>\n
MySQL<\/h4>\n
\n
\n
\n
[client]\nssl_ca=\/etc\/pki\/tls\/certs\/ca-cert.pem\nssl_cert=\/etc\/pki\/tls\/certs\/mysql\/client-cert.pem\nssl_key=\/etc\/pki\/tls\/certs\/mysql\/client-key.pem\n\n[mysqld]\n# Set to the amount of RAM for the most important data cache in MySQL.\n# Start at 70% of total RAM for dedicated server, else 10%.\ninnodb_buffer_pool_size = 128M\n\ndatadir=\/var\/lib\/mysql\nsocket=\/var\/lib\/mysql\/mysql.sock\n\nsql_mode=NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES\n\ncharacter_set_server=utf8\n\nssl_ca=\/etc\/pki\/tls\/certs\/ca-cert.pem\nssl_cert=\/etc\/pki\/tls\/certs\/mysql\/server-cert.pem\nssl_key=\/etc\/pki\/tls\/certs\/mysql\/server-key.pem\n\n[mysqld_safe]\nlog-error=\/var\/log\/mysqld.log\npid-file=\/var\/run\/mysqld\/mysqld.pid<\/pre>\n<\/blockquote>\n
\n
\n
SET PASSWORD FOR 'root'@'127.0.0.1' = PASSWORD('mypassword');\nSET PASSWORD FOR 'root'@'::1' = PASSWORD('mypassword');\nSET PASSWORD FOR 'root'@'localhost' = PASSWORD('mypassword');\nDROP DATABASE test;\nquit<\/pre>\n<\/blockquote>\nphpMyAdmin<\/h4>\n
\n
\n
Alias \/phpmyadmin \/var\/www\/html\/phpmyadmin\n\n<Directory \/var\/www\/html\/phpmyadmin>\n Options -Indexes\n<\/Directory>\n\n<Directory \/var\/www\/html\/phpmyadmin\/setup>\n Order Deny,Allow\n Deny from All\n<\/Directory>\n\n<Directory \/var\/www\/html\/phpmyadmin\/libraries>\n Order Deny,Allow\n Deny from All\n<\/Directory><\/pre>\n
\n
$cfg['blowfish_secret'] = '5@#@7ecr39R@musU99GAkE+!ASt63$aB+es3zedu_ep$ey'\t \/* Change to your own password *\/<\/pre>\n<\/blockquote>\n