Let's say I have two databases on the same server (e.g. AWS RDS), DB1 and DB2. There are two users with some restrictions, and each user is assigned to a different database. US1 have access to DB1, and US2 have access to DB2.

The users and their passwords are stored separately on different servers. DB1 is used to store ciphertext, and DB2 to store the encryption keys.

Can I be sure, in 100%, that without the passwords (ignoring bruteforcing and other attacks on the password itself), that while having access to only one of the users, an attacker won't be able to access the other database?

2 Answers 2


If you set the permissions correctly, yes, you can be sure.

To grant user US1 select, insert, delete permissions to database DB1 use this query:


or for all privileges

GRANT ALL ON DB1.* TO 'US1'@'host';

This way US1 can see and interact with DB1, while unable to interact with DB2.

You can test this by authenticating as user US1 and using the query: show databases; via the command line or phpmyadmin. You will only see DB1 in the results.

  • So basically there is no way there could be a backdoor that will allow an attacker to access DB2 via US1?
    – Theodore
    Dec 28, 2016 at 13:14
  • Obviously there are privilege escalation bugs around, but if you keep your server up-to-date these shouldn't be a problem.
    – Zwans
    Dec 28, 2016 at 13:18

If you access the DB2 server that stores encryption keys, bruteforcing becomes easier, but it does not mean instant access to the other database. In the other case, accessing ciphertext should not be a problem if the encryption algorithm is strong enough.

  • Yeh, but it can be a problem if you have the keys. Dec 28, 2016 at 13:12
  • You don't have the keys. You only have the ciphertext in that case... Dec 28, 2016 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .