4 ms·
Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though
by pilif 12y ago
Tangentially related, I'd like an opinion on this:
>Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password.
What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password.
That means that an attacker who gains access to the application can easily just look at the file where the password is stored and then use that to access the database.
Even if you'd go great lengths at keeping asking for the password at server start and only keeping it in memory - once an attacker is on the application server, the password is in memory and can be snooped.
So the question is: Why even use a password for the web application? In my case, I'll just let the application servers connect to the database without password.
- raverbashing 12y agoDifferent access levels? (your app may not have the right to erase data/drop tables for example) Auditing (per tool)? Not all attackers come "through the front door"
- pilif 12y agoYes. But I'm talking about the password for the account that the web application itself is using. That one IMHO is superflous. Other access levels, of course, might require a password.
- raverbashing 12y agoAh I see your point, it might be a good idea, to make the webapp account have the least amount of privileges possible.
- dsl 12y agoA password means you can't access the database server from a mail server or file server. Complex environments have more than just a database server and a few web servers.
- pilif 12y agoThat's why my pg_hba.conf is configured to only allow app servers passwordless access.
- daigoba66 12y agoBingo. And in the MSSQL world it's common to also have Active Directory and use that for authentication (each server automatically has a unique "account", and SQL login permission can be granted using that).
- ThrustVectoring 12y ago>What is the point on even having a database password? Fuck-ups happen, and an insecure password does a good job of preventing any activity that doesn't explicitly include the password. Like, suppose you have some dev tool that does things to a database. If your local dev environment does not have a password on the db, and the application environment does, odds are your tool is going to work locally but not in the application environment. Basically, it can be a form of "type 'password1' if you are sure you want to do things to prod".
- eveningcoffee 12y agoOracle enterprise edition had (and probably has today too) a feature to link a pl/sql procedure to a table such that this procedure is called every time a query is ran on that table. This procedure then can apply additional predicates to the query. When this procedure belongs to the schema that is not directly accessible to the user, then it would be possible to create a filter such that only logged in user can see the records and only her records.
- dredmorbius 12y agoAmong other reasons: setting different passwords for different staging levels or databases reduces the chances of accidentally shooting yourself in the foot. "Oh, our staging code references the prod DB password. Wups!" Passwords can also be changed and rotated with some frequency, though that's more often observed in the breech. Preferably not the data breech.