* Posts by Void Main

1 publicly visible post • joined 20 Jun 2006

Examples of good practice, or not...

Void Main

To nitpick and get farther off topic but everyone here is wrong so far...

Just kidding about the everyone being wrong part but I "cringe" (as the other commenter put it) when I see people "GRANT ALL" to database web accounts that should really be restricted to bare minimum required access. It's much like when I see people tell other people to "chmod -R 777 /var/www/html" their web directories, or set ownership to the owner of the web server process. These people will surely get 03n3d by k1dd13 h4x0rs sooner or later. So, if the web user will only need SELECT and INSERT on MYTABLE in MYDATABASE then only grant then SELECT and INSERT on MYTABLE in MYDATABASE. I don't think there is anything wrong with using proper/secure examples if you are going to use examples at all.

GRANT SELECT,INSERT on mydatabase.mytable TO 'mywebuser'@'localhost' IDENTIFIED BY 'mypassword';

Web accounts typically will also need DELETE and UPDATE privileges but they usually don't need to create or delete tables for instance. Just give the account what it needs. Applying any security measures you can wherever you can might save you some embarrassment down the road (and if you are lucky, only embarrassment).