1

I have created a CMS website that only had one database connection for both the admin area and the user area and it only had one user("root") with no password, and now I want to upload it, but I am not sure whether I should create 2 different users(and two distinct connections) one for the admin and the other just for displaying purposes for the site visitor(making it more restrict), In order to keep it more secure. Or does it not matter how many users one creates when looking at a security point of view?

  • 1
    You should definitely not be using root for a website to database connection. Create at least an account with just enough priviledges to the CMS database, don't use root! – Tom V - try topanswers.xyz May 28 '15 at 18:20
1

You should at least not be using root for your application. The rest completely depends on how the application was developed. It sounds like you wrote it yourself, so my opinion is based on that.

My suggestion is to use two accounts, as you said one for write access (to the CMS database only) and one with read-only access (again, only for your CMS database). That way, if you have any kind of vulnerability with, for instance, the display portion of your application, you can somewhat potentially limit the damage an attacker can do.

You could do it with one user for the whole CMS; most applications you could download like WordPress and so on do it this way to make installation easier and because some hosts don't allow more than one user account. If you have the means to do so, I prefer to isolate roles as much as possible.

The reasons to not use root are many, but basically you want to give the user the minimal set of permissions needed; if an attacker gains access through your root account they can create new users, delete data, change configuration variables, and much, much more. If they gain access through a limited account that only has access to read and write to your CMS database, they can't create accounts, they can't delete other databases, and they can't insert malicious data in to other databases. They might mess with your CMS database, but it's the principle of limiting the damage at that point.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.