1

I have a first server running a Postgres database. I have allowed remote access to this database, using certificates for authentification (following this tutorial).

Now I have a second server running a Django app on Apache. The user used by Apache is www-data, and I have understood it is good practice to give this user very restricted permissions.

In order to let django access its remote DB, I have added a .postgresql folder in the user www-data home folder (ie /var/wwww) containing all the needed files - root.crt (trusted root certificate), postgresql.crt (client certificate) and postgresql.key (client private key).

Of course if 'someone' gets access to those files, he will be able to connect to my DB and read/write on it.

Is this setup dangerous? If yes, can it be avoided?

  • 2
    At some point your webserver has to access the database, and an attacker might be able to connect then. – trognanders Oct 26 '16 at 17:42
0

Your application needs a way to access the database so I don't see any risk. For someone to steal the cert they would have to compromise the application and at that point they could issue queries anyway.

Just make sure the cert only allows access to the minimum the app needs to function (least privilege) and if possible lock down the access to the web server's IP, so a stolen cert can't be reused from another machine.

1

Ultimately, the web server needs access to its database. Using file permissions for a limited user is a tried and true way to do this, so I don't think you are doing anything inappropriate here. There are some tools - like Hashicorp's Vault, KeyWhiz, etc - that provide some alternatives to this, but even those ultimately need SOME way of identifying the valid user (though they give you some alternatives, like allowing one and only one request from a given EC2 instance which may be more secure in some instances, especially in a situation where you are autoscaling and if an instance fails it is torn down.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.