Re: Mysql-CGI Security Question

I always set up web-site systems ... those which cannot offload the entire “authentication question” to something like LDAP ... to initially connect to the database using a userid/password that gives only read-only permission to the authentication table. Once the user is authenticated, the web-site software might choose to re-authenticate itself using one of several userid/password combinations, but none of them are rootly. The idea, simply, is “the principle of least privilege.” Each of the several tasks which the web-site might do are compartmentalized, and while performing each of those functions the web-process has only the privileges which it requires to do that job ... and no more.

Replies are listed 'Best First'.
Re^2: Mysql-CGI Security Question by jhourcle (Prior) on Aug 05, 2011 at 16:46 UTC
I work similarly -- I have at least three classes of mysql logins: Unauthenticated -- only has read access to the public tables Authenticated -- may also have read to user-level tables, and possibly write or insert to tables where appropriate (I don't always use this one, as my stuff tends to be more information push in nature) Web Administrator -- just for authenticated administrators, may be allowed to insert / delete / update to perform administrative tasks Local Admin -- not used by the CGI, but for interactive use ... may be allowed bulk data loads (FILE), truncate, create / alter tables, etc, with that application's schema. Rootly powers (eg, ability to modify the mysql schema) are never given to CGI scripts, nor are any powers that the web user wouldn't need to do. In some cases, the public facing webserver doesn't actually have valid webadmin credentials -- those are only on a separate virtual host that's restricted to connections from specific IPs. I also don't store authenticaton information within the database ... if I were going to, I'd likely separate read & write of passwords out to two separate roles, to reduce the ability of injection to obtain the passwords. If I had more roles that needed different permissions, I'd create seperate mysql logins for them, too.	[reply]

Replies are listed 'Best First'.

Re^2: Mysql-CGI Security Question
by jhourcle (Prior) on Aug 05, 2011 at 16:46 UTC

I work similarly -- I have at least three classes of mysql logins:

Unauthenticated -- only has read access to the public tables
Authenticated -- may also have read to user-level tables, and possibly write or insert to tables where appropriate (I don't always use this one, as my stuff tends to be more information push in nature)
Web Administrator -- just for authenticated administrators, may be allowed to insert / delete / update to perform administrative tasks
Local Admin -- not used by the CGI, but for interactive use ... may be allowed bulk data loads (FILE), truncate, create / alter tables, etc, with that application's schema.

Rootly powers (eg, ability to modify the mysql schema) are never given to CGI scripts, nor are any powers that the web user wouldn't need to do. In some cases, the public facing webserver doesn't actually have valid webadmin credentials -- those are only on a separate virtual host that's restricted to connections from specific IPs.

I also don't store authenticaton information within the database ... if I were going to, I'd likely separate read & write of passwords out to two separate roles, to reduce the ability of injection to obtain the passwords. If I had more roles that needed different permissions, I'd create seperate mysql logins for them, too.

[reply]