2

I have 1 website which has alot of databases, approximately 7 - 8.

Should I use 1 username and password to access all databases, or each database has its own username and password?

5 Answers 5

2

There is no real right answer for this.

Security dictates you should use multiple usernames and passwords, but this can greatly increase the configuration required of the application.

Logic dictates that unless there's a specific reason why someone who has access to one database should be denied access to another database, then using the same username/password should be fine.

However, if you want to make sure that one user who has access to one database does NOT have access to another database, then of course, you should use multiple usernames and passwords.

1
  • 2
    I like to take the middle road. Each logical separation gets a different user. So you front-end services have one users, back-end services another, etc.
    – Zypher
    Feb 2, 2010 at 3:26
2

I would say no, and my argument stems from the "eggs in one basket" model.

With only one account, if your account gets compromised, you lose 8 databases, where as if you have one user per database, you're only out one database.

The other argument is that you should put your eggs in one basket, "after making sure you've got a damned good basket". IMO, MySQL username / password combinations aren't a good enough basket.

Now, if you wanted to bind mysql to 127.0.0.1 so that no one external could connect, you'd have the start of a better policy. Of course, I'd still assign different users to each DB. Defense in depth.

1

NO, you should use a different username and password combination for each databases!!! I use http://www.grc.com/password to generate my db passwords. Works great! Also, you should give the "user" the most restrictive permissions you can and still have it be able to accomplish all of its tasks.

1

First, 7 or 8 is not what most of us would consider a lot. :)

While I agree with Farseeker in that there is no real correct answer I personally prefer a separate user for each database. It just adds a sensible layer of separation.

As there is normally a reason for having multiple databases, rather than just adding more tables to a single database you'll find that the same logic generally applies to the accounts used to access those databases. There are of course always exceptions.

0

I'd say absolutely yes, and ensure that the username/password is only known to this application and nothing else. Anyone else who needs access to the other databases can use different credentials with different permissions.

You've not said whether they were on separate servers or not, but it doesn't really make any difference.

In any case, having 7-8 databases should not really be a problem provided your test systems is set up in a similar way so that your developers can release working code.

You must log in to answer this question.