Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Before launch of a project, I reset the server's mysql root password. The colo that is hosting project wants the server's root database password stored in the .my.cnf file, in plain text, with the permissions set to 400. I just can't see how that is good security practice, but he said that it was something that was being done commonly.
Is it secure to store a the root database password in plain text in the .my.cnf file?
Of course any password that is stored in plain text is a bad idea but the location of the file is in /etc/my.cnf so if a remote user had access to that file I think there would be more things to worry about than having your mysql password stolen. On the other hand if you are not the only one who has physical access to the system then you are still safe from others reading your file since your file permissions are 400, assuming no one escalated privileges on the system. I did some research about having your password in my.cnf file and it's true it's actually a pretty common practice.
By the way you need to make sure you don't actually edit the file thats located in the /etc/my.cnf which mysql server uses to boot up because if you do anyone can use the server with ALL privileges and ALL databases without a password. So instead create a file in your local /root directory call it my.cnf and make sure only root can read it (of course)
The easiest way to do this is to use a client section of the ~/.my.cnf file, and add the credentials inside that file.
[client]
user=root
password=somepassword
Like I said make sure the file is ONLY readable by root. –
I am sorry but if they told me they wanted me to plain text my database password I would say "nope". Now I have heard on cPanel servers running phpMyAdmin use that file to install and uninstall Site Software, which I sorta understand, still think it can be done better. I have never placed my DB password in the .my.cnf thats just asking for a simple LFI attack.
In my opinion it is not safe, even with the permissions set to 600. chmod 600 .my.cnf
Edit: I thought about this more and I can see that this might be an acceptable method you want to invoke a client from a script that runs noninteractively, there is no opportunity to enter the password from the keyboard. On some systems, the first line of the script is read and interpreted (incorrectly) as your password.
But defiantly keep that file set on 600. regardless, I still feel its bad practice.
