0

I'm a web developer / sys admin and I'm reading about the security of (for example) MySQL user authentication for the web apps and any other use case that involves local authentication in this context, like a framework for an online game.

I've come across some questions and it seems that everyone agrees on using strong passwords for local MySQL users. I'm using the same thing for user/dbname/password (edit: only for development!).

My question is, if the user is only allowed to be used in localhost/127.0.0.1, then, what is the purpose of the password? If someone gains access to the system then they can access the database files and get the passwords from the .php files. Also, if a virus has infected the system it doesn't matter how strong the password is, again, it can access the files.

In what scenario would a (strong) local user password really protected the databases?

Would someone be so kind to explain this in detail? I'd appreciate it.

  • Are you using a single account for the application and for administration purposes? Your application probably doesn't need full root access to the db, after all – Matthew Jul 25 '17 at 19:57
  • No, my applications are not using root access, they all have their own user with permissions only for the database the app is using. And I have a user with a strong password for remote management and it can only be used from my IP (dynamic but I don't mind changing it, I may use a dyndns or something). – Chazy Chaz Jul 25 '17 at 20:03
2

Say, for example, you had an upload page that accidentally allowed upload of php files to an executable directory or had an accidental php EXEC running on a string that a user could get a value in to.

In these cases (and many others) an attacker does not necessarily have access to files on your server, but could still execute arbitrary code that they can upload. Insecure passwords for the MySQL local user make it easier to compromise with such code.

Good segmentation of file access permissions also can help separate multiple sites or services running on the same machine, however, it is possible for an attack against the MySQL instance (if only checking for localhost) to be compromised across sites and services since it is not aware of the executing user, only the IP address of the client.

  • So basically a strong password would be a fail-safe for vulnerabilities/bugs/typos in both the web-app and the server-software? With your last paragraph do you mean that, in a shared hosting, would be possible to attack other instances (mysqld, sshd, etc) with php code? How can an instance, mysqld for example, be compromised? Aside from specifying another users' mysql user and password? I know that shared hostings hard code a prefix to the user and db name, but is it just client-side? Or is it a server-side thing (in php $user='client1_' . $input)? Is that what you mean? Please, elaborate :) – Chazy Chaz Jul 25 '17 at 22:02
  • It is defense in depth. There are many, many situations where an attacker can originate from localhost without having access to read the site code that contains the MySQL credentials. Shared hosting is one example where other customers collocated on the same hardware connect from localhost. A strong password prevents them from breaking in to your db. – AJ Henderson Jul 25 '17 at 22:07
  • Ok, so last question. What I want to know is, in a dedicated server, if those attacks that originate from localhost could only work through bugs/typos in the web-app/server-software. Meaning that if the web-app is well written and the server well configured there shouldn't be any breaches that allows arbitrary code/commands to be executed, right? Just curious, I'm not gonna use a weak and predictable password for production. – Chazy Chaz Jul 25 '17 at 22:55
  • @ChazyChaz - yes, in an ideal world, with no bugs or security vulnerabilities, the password for the DB wouldn't matter. You could just put it as accepting any connection from localhost with no password at all since if there aren't other compromises, then nothing outside your control would run on localhost. However, there are always bugs and vulnerabilities, even in well written software. – AJ Henderson Jul 25 '17 at 23:04
  • 1
    As well you should. If you don't understand the "why" in security, you are likely to mess up the "how". – AJ Henderson Jul 26 '17 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.