3

Let's say I have two databases on the same server (e.g. AWS RDS), DB1 and DB2. There are two users with some restrictions, and each user is assigned to a different database. US1 have access to DB1, and US2 have access to DB2.

The users and their passwords are stored separately on different servers. DB1 is used to store ciphertext, and DB2 to store the encryption keys.

Can I be sure, in 100%, that without the passwords (ignoring bruteforcing and other attacks on the password itself), that while having access to only one of the users, an attacker won't be able to access the other database?

1

If you set the permissions correctly, yes, you can be sure.

To grant user US1 select, insert, delete permissions to database DB1 use this query:

GRANT SELECT, INSERT, DELETE ON DB1.* TO 'US1'@'host';

or for all privileges

GRANT ALL ON DB1.* TO 'US1'@'host';

This way US1 can see and interact with DB1, while unable to interact with DB2.

You can test this by authenticating as user US1 and using the query: show databases; via the command line or phpmyadmin. You will only see DB1 in the results.

| improve this answer | |
  • So basically there is no way there could be a backdoor that will allow an attacker to access DB2 via US1? – Theodore Dec 28 '16 at 13:14
  • Obviously there are privilege escalation bugs around, but if you keep your server up-to-date these shouldn't be a problem. – Zwans Dec 28 '16 at 13:18
-1

If you access the DB2 server that stores encryption keys, bruteforcing becomes easier, but it does not mean instant access to the other database. In the other case, accessing ciphertext should not be a problem if the encryption algorithm is strong enough.

| improve this answer | |
  • Yeh, but it can be a problem if you have the keys. – Vlad Gincher Dec 28 '16 at 13:12
  • You don't have the keys. You only have the ciphertext in that case... – Rápli András Dec 28 '16 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.