Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I would like to know what exactly I am password protecting on my server when I set a database password. I am unclear as to what people are referring to when saying to password protect a database. Are they referring to a single specific database or do they mean the complete mysql database structure located on the server. The reason I ask is because, when I set a password, it is only one password for all my databases that I'm managing in phpMyAdmin. So when I'm required to enter the password in my config file in codeigniter, it is always the same one for all my different databases that I'm using. Is the password that I'm required to enter in order to even get phpMyAdmin started the Database Password which people refer to, or can I (and should I) set different passwords for my seperate Databases?

share|improve this question
    
Succinct quote from the chat room when your question was posted: "Send me your password and I'll tell you what you're protecting." –  Mark Storey-Smith Jan 24 '13 at 22:41
add comment

2 Answers

up vote 5 down vote accepted

The passwords you're talking about are passwords for MySQL users. You don't really set a password for a database or table. You can effectively implement different passwords for different DBs by creating multiple users with different passwords and only granting access to specific databases for each user. When people say that you should set a password for the database, they probably mean that you shouldn't use users with no password, which is possible, but shouldn't be done due to the obvious security concerns.

Whether or not you "should" use multiple users depends on your situation. If you have multiple databases that are used by independent applications, it is a good idea to create a user for each application to help isolate any risks from spreading between applications via the database. If you have one database that is used by different applications, you can use different users to help track stuff or lock down permissions. If you have on application, you're generally safe with using just one user.

The main reason to use different users is to lock down permissions and prevent any errors/attacks from causing too much damage. If you're performing a task that only needs to read data, using a user that only has SELECT permissions can prevent accidental deleting or modifying of data; even though the risk of such an event is very low, it is still good to have something to prevent it. Using different users is usually only helpful when all of the users would see significant use. In your situation, you could use multiple users, but it would probably become more of a nuisance for you to keep track of when you would use which user and which user is currently connected.

share|improve this answer
    
Thanks. I was always very confused as people kept saying to "set a database password" –  TheBaj Jan 24 '13 at 22:22
add comment

This is just some supplemental information from G-Nuget's answer since I'm still unable to post comments.

The passwords are for database users. The users have a set of permissions(SELECT, INSERT, EXEC...), Roles(Root,DBA,...) and access to tables/views/databases which can also be configured to be on able to be accessible only from a specific ip address/range. For example, you can restrict root to only be accessible from localhost, meaning that any remote device trying to remotely login to your db server as root will be denied.

Also, you should always use multiple users on your database/tables in order to lock down permissions even if you only have one database being accessed by one application. Since you're using phpmyAdmin, its safe to assume that you are creating a website or web application. Database and web apps mean that you allow input and output from forms for most cases, in the case of form inputs, you are susceptible to SQL Injection attacks which could possibly pull out a drop table from what should be just a simple and harmless select or insert query. Of course, proper code sanitation can also prevent this, but its still better safe than sorry.

Even if you are only on a dev environment, still practice using multiple users to lock down database and table permissions in order to keep it as a best practice and reduce the effort of moving from a single user database to a multi-user locked down database. Doing so will add some complexity to the program, but its better than having your data stolen, or worse, destroyed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.