Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 1 website which has alot of databases, approximately 7 - 8.

Should I use 1 username and password to access all databases, or each database has its own username and password?

share|improve this question

5 Answers 5

NO, you should use a different username and password combination for each databases!!! I use http://www.grc.com/password to generate my db passwords. Works great! Also, you should give the "user" the most restrictive permissions you can and still have it be able to accomplish all of its tasks.

share|improve this answer

There is no real right answer for this.

Security dictates you should use multiple usernames and passwords, but this can greatly increase the configuration required of the application.

Logic dictates that unless there's a specific reason why someone who has access to one database should be denied access to another database, then using the same username/password should be fine.

However, if you want to make sure that one user who has access to one database does NOT have access to another database, then of course, you should use multiple usernames and passwords.

share|improve this answer
2  
I like to take the middle road. Each logical separation gets a different user. So you front-end services have one users, back-end services another, etc. –  Zypher Feb 2 '10 at 3:26

First, 7 or 8 is not what most of us would consider a lot. :)

While I agree with Farseeker in that there is no real correct answer I personally prefer a separate user for each database. It just adds a sensible layer of separation.

As there is normally a reason for having multiple databases, rather than just adding more tables to a single database you'll find that the same logic generally applies to the accounts used to access those databases. There are of course always exceptions.

share|improve this answer

I would say no, and my argument stems from the "eggs in one basket" model.

With only one account, if your account gets compromised, you lose 8 databases, where as if you have one user per database, you're only out one database.

The other argument is that you should put your eggs in one basket, "after making sure you've got a damned good basket". IMO, MySQL username / password combinations aren't a good enough basket.

Now, if you wanted to bind mysql to 127.0.0.1 so that no one external could connect, you'd have the start of a better policy. Of course, I'd still assign different users to each DB. Defense in depth.

share|improve this answer

I'd say absolutely yes, and ensure that the username/password is only known to this application and nothing else. Anyone else who needs access to the other databases can use different credentials with different permissions.

You've not said whether they were on separate servers or not, but it doesn't really make any difference.

In any case, having 7-8 databases should not really be a problem provided your test systems is set up in a similar way so that your developers can release working code.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.