Assume we have a two MySQL database users with corresponding databases with the same name (db1, db2), encapsulated inside one central database central_db (which also includes an information_schema) and controlled by the user root.

The root user's password is unique, but the two non-root db users has their own password, which is identical in both cases.

I assume that changing the password of non-root db1 or db2 so that each of the two will have a different password wouldn't have significant effect on security because if the root user hacked, the passwords of the aforementioned to non-root users wouldn't really matter.

Am I correct?


Having separate database users (with separate passwords), in addition to the root user, is good practice. This allows you to protect the data for each database, so that if the password to one database is lost, it doesn't compromise the data in the other database. And you don't have to use the root password anywhere, except when doing database maintenance.

In other words, the difference between shared login for all database users, and separate logins, is that the attacker can access less data when you use separate logins. Because even if the attacker cannot access root, they can still read the data belonging to the compromised user, and maybe do some damage. But the rest of your database is protected.

This is because the most likely way attackers will gain access to your database is either through some SQL-injection type exploit in the application, or by gaining access to your network in some way, and discovering the account credentials in configuration files.

In the first case, you only lose the data in the database with the exploit. In the second case (with an attacker in your network), they still only get access to the data in the database with the leaked configuration. An in neither case will the attacker be able to access the root account.

It comes down to the principle of least privilege.

In addition, you can have different key rotation schemes for the two accounts, both in terms of how often you change passwords, and how you distribute them. And that, I suspect, is the most practical value in having different passwords. Over time, the passwords would probably diverge anyway, or cause a lot of operational headaches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.