Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister
 
PerlMonks  

Re^2: Mysql-CGI Security Question

by jhourcle (Prior)
on Aug 05, 2011 at 16:46 UTC ( #918825=note: print w/ replies, xml ) Need Help??


in reply to Re: Mysql-CGI Security Question
in thread Mysql-CGI Security Question

I work similarly -- I have at least three classes of mysql logins:

  • Unauthenticated -- only has read access to the public tables
  • Authenticated -- may also have read to user-level tables, and possibly write or insert to tables where appropriate (I don't always use this one, as my stuff tends to be more information push in nature)
  • Web Administrator -- just for authenticated administrators, may be allowed to insert / delete / update to perform administrative tasks
  • Local Admin -- not used by the CGI, but for interactive use ... may be allowed bulk data loads (FILE), truncate, create / alter tables, etc, with that application's schema.

Rootly powers (eg, ability to modify the mysql schema) are never given to CGI scripts, nor are any powers that the web user wouldn't need to do. In some cases, the public facing webserver doesn't actually have valid webadmin credentials -- those are only on a separate virtual host that's restricted to connections from specific IPs.

I also don't store authenticaton information within the database ... if I were going to, I'd likely separate read & write of passwords out to two separate roles, to reduce the ability of injection to obtain the passwords. If I had more roles that needed different permissions, I'd create seperate mysql logins for them, too.


Comment on Re^2: Mysql-CGI Security Question

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://918825]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others cooling their heels in the Monastery: (7)
As of 2014-12-28 06:06 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    Is guessing a good strategy for surviving in the IT business?





    Results (178 votes), past polls