1

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure?

The background for my question is: I want to get rid of having to manage all the database user passwords used by various web applications when accessing MySQL and PostgreSQL databases. In all cases when the DB and the App(s) are on the same host, domain socket authentication seems to be the best way to connect them, assuming that each app runs as a separate user.

This mechanism however seems to be very rarely used. Most web apps provide installation instructions proposing password authentication, most linux distributions use passwords by default (infamous MySQL root password) even if DBs are preconfigured for local access only.

I wonder whether there is a good reason to stick to passwords which seems to have only disadvantages (if you impersonate as the user you get their password from the config files and can then access the database without having to re-gain access to the user account).

Improve this question
4
  • 1
    Anecdotal evidence: I know that by default MySQL will do some form of challenge-response auth which is difficult to break, but the actual communications after that are not encrypted by default. You also have to have encryption enabled on BOTH the client and server for it to be enabled. There's also no integrity protection - I wrote a small tool for injecting queries into existing connections. – Polynomial Nov 4 '14 at 16:07
  • But this is independent of the authentication method used and specific for using domain sockets vs. TCP/IP, right? – Michael Nov 4 '14 at 18:16
  • As far as I'm aware, TCP/IP vs. Unix sockets are just seen as different communications layers, which the actual protocol is agnostic to. That being said, I've only taken enough of a look at the protocol to emulate a couple of the packet types, and that was entirely on TCP/IP. – Polynomial Nov 4 '14 at 21:05
  • To do something like that you would need to have access to relevant fd's in /proc to tap into the communication, right? Is that somehow related to whether I store passwords in environment variables or config files or instead rely on authentication via peer credentials provided by the domain socket? – Michael Nov 4 '14 at 21:50
0

The MySQL SO_PEERCRED authentication is fairly recent, it was added in version 5.5.10, March 2011. The similar Postgres authentication is a lot older. (Note that Postgres also supports ident, RFC 1413, authentication; MySQL does not, that would be another plugin, perhaps someone will write it.) The relative newness of the feature in MySQL would be one reason you don't see a lot of web apps using it.

The other reason is that, once the app gets enough use, the first thing you'll do for performance or reliability is to move the database to a different host, whereupon you'll have to set up a password (or some other method of authentication) anyway.

As far as security, however, I would say this method is very secure. It depends on the kernel for the security guarantee, that's all.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.