7

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password.

If mysql only responds on localhost, does it really need a strong password?

Sure, if there was an exploit on the server which allowed an attacker to upload and run PHP files, they could wreak havoc on the database if there wasn't a secure password. However they could still use that PHP file to access the 'real' server scripts, send them to the client, then read the password that way.

I really don't understand the need for a mysql password if it only responds to localhost. Why is it important?

When I say 'no password' I mean leaving it as the default value of 'password' which is probably the first guess for an attacker

5

A few reasons come to mind:

Firstly, just because a compromised hosting account can read the credentials of one MySQL user doesn't mean they can read another. Imagine you're on a shared host and one of your co-tenants is compromised, you wouldn't want them brute forcing your password.

Secondly, you might use a number of different users with different permissions within your own systems. For example, one user may be read-only which is used for a publicly accessible site, whereas your admin console uses a user with write access. This would possibly prevent privilege escalation for accounts stored within the database if the publicly accessible system gets compromised - assuming they can't brute force your other MySQL password.

Finally, it's not that uncommon to make MySQL accessible externally so tools like MySQL workbench can be used to manage and query it. In this case you obviously want a strong password.

  • 1
    In case you make MySQL's administrative functions accessible from outside the system, you also should use encrypted connections to access them. A strong password is worthless when it can be sniffed. – Rüdiger Voigt May 3 '14 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.