# Security Hardening

> RBAC configuration, row policies, quotas, network security, audit logging, and access control best practices.

- Skill: `terrylica/security-hardening` (Agent Skill)
- Install (CLI): `npx skillmds@latest add terrylica/security-hardening`
- Raw SKILL.md: https://api.skillmd.com/api/skills/terrylica/security-hardening/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: terrylica (https://skillmd.com/u/terrylica)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/terrylica/security-hardening

---


# Security Hardening

## RBAC (Role-Based Access Control)
- Create roles: `CREATE ROLE analyst`
- Grant permissions: `GRANT SELECT ON db.* TO analyst`
- Assign to users: `GRANT analyst TO user1`
- Hierarchical: roles can inherit from other roles
- Check grants: `SHOW GRANTS FOR user1`
- Inspect user: `SHOW CREATE USER username`
- Password rotation: `ALTER USER username IDENTIFIED BY 'new_password'`

## Row Policies
- Restrict row access per user: `CREATE ROW POLICY p ON db.table FOR SELECT USING tenant_id = currentUser()`
- Policies are AND-ed together
- Use for multi-tenant data isolation
- Check policies: `system.row_policies`

## Quotas
- Limit resource usage per user/IP: `CREATE QUOTA q FOR user1 ... LIMIT max_queries = 100`
- Quota intervals: per hour, per day, etc.
- Limits: max_queries, max_result_rows, max_read_rows, max_execution_time
- Monitor: `system.quota_usage`

## Network Security
- Restrict user access by IP: `CREATE USER u HOST IP '10.0.0.0/8'`
- Use TLS for client connections
- Inter-server encryption for replication
- Separate ports for internal vs external access

## Audit Logging
- Enable `system.session_log` for login tracking
- `system.query_log` records all queries with user info
- `system.text_log` for server-level events
- Configure log retention with TTL

## Best Practices
- Principle of least privilege — grant only needed permissions
- Use roles, not direct user grants
- Separate read-only and admin users
- Enable quotas for all non-admin users
- Regular audit of grants and access patterns
- Use `readonly = 1` setting for monitoring connections