Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is this line bad practice from a security stance?

connect = mysql_real_connect(connection, "host", "user", "password", "database", 0, (const char *)NULL, 0);

If so, what solution would you use?

Edit

void get_credentials(char* host, char* name, char* passwd, char* db) {
  char string_path[80] = "/etc/.acro";
  struct stat sb;
  stat(string_path, &sb);
  int file_OK = FILE_OK;
  if (sb.st_mode == 0644) {
    fprintf(stderr, "Corrupt login file: permissions");
    file_OK = FILE_BAD;
  }
  /* if(file_meta->st_uid != ???) {
       fprintf(stderr, "Corrupt login file: owner");
       file_OK = FILE_BAD;
     } */
  if(file_OK) {
    FILE *login_file = fopen(string_path, "r");
    fgets(host, 80, login_file);
    fgets(name, 80, login_file);
    fgets(passwd, 80, login_file);
    fgets(db, 80, login_file);
    host[strcspn (host, "\n")] = '\0';
    name[strcspn (name, "\n")] = '\0';
    passwd[strcspn (passwd, "\n")] = '\0';
    db[strcspn (db, "\n")] = '\0';
    fclose(login_file);
  }
}

Edit 2

The permission check should look like this for a 700 file:

// 33216 = 100700 in octal => rwx for owner only
if (sb.st_mode != 33216) { 
    printf("Corrupt login file: permissions");
    file_OK = FILE_BAD;
}
share|improve this question
add comment

migrated from unix.stackexchange.com Jul 3 '12 at 22:58

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems..

1 Answer

up vote 8 down vote accepted

Yes, for several reasons.

One, someone with read access to the binary could potentially run the strings command and look for likely possibilities near the phrase 'localhost'.

Two, if you ever decide to use the program elsewhere, you currently have the options of 1) setting up the exact same database on localhost with the exact same username and password (really unwise) or 2) altering the source code and recompiling for the second platform.

Alter the program to read its connection data from a config file in either /etc/programname/program.conf or ~/.programname/ depending on the flavor, and make it insist on having the directory permissions set to 700 and enforce proper ownership.

share|improve this answer
    
See the edit. I got server error if I took away the read rights. 644 was the lowest I got (on group and other). Also, I didn't understand what you said about ownership? (This is the commented region.) –  Emanuel Berg Jul 4 '12 at 23:39
    
By that I meant that the owner of the config file should be the same user that your program is going to run as -- IE, if it's a daemon running under the nobody user, then the file owner should be nobody; if it's going to be run on a per-user basis, it should check whether ~/.programname/ and ~/.programname/config are owned by the user in question and set to 0700 . –  Shadur Jul 5 '12 at 4:39
    
Also, it's considered exceptionally bad form to use 'hidden' directories in /etc/. Use /etc/acro instead. –  Shadur Jul 5 '12 at 4:40
    
It is a web interface that reads from a database. Right now, when I use my ordinary user and start a browser, and try, it crashes if the permissions of the login file are 0700 (not because of the check). It needs read rights, probably because of the fopen line. Or, will this be OK when I have the correct owner? And what should that be? Hidden: It is not a directory but a file, but OK, removed the dot. –  Emanuel Berg Jul 5 '12 at 18:34
    
If it's a web interface, it's likely running as the apache user -- run ps axuf while connecting via the browser and it should tell you what user the httpd process is running as. That's the username you need to set the ownership to. –  Shadur Jul 6 '12 at 4:24
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.