Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server running Ubuntu 10, it mostly has PHP websites with MySQL databases.

I need to write a backup script

  1. to backup the database
  2. to zip up all the php files.

Is it better security to do write my backup script in PHP or shell? Or does it not matter?

I like PHP more, because that lets me have the database password in only one place, a PHP file.

If I write this in shell, then Ill need to put the database password in the shell script. When I change the password, then Ill need to change it in two places.

share|improve this question

closed as not constructive by womble, voretaq7 Jul 24 '12 at 15:59

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
is your server used by other users ? –  Pedro Lobito Aug 21 '11 at 16:20
2  
Option 3: don't write a script yourself, and instead use one by someone who knows what they're doing and has already solved all of these problems. –  womble Aug 21 '11 at 23:11

2 Answers 2

up vote 1 down vote accepted

Speaking form the security point of view, best would be if your mysql password would not be exposed at all / be hardcoded in the script. Both php and shell scripts will need the password decrypted if you plan to execute an external tool, such as mysqldump, to backup up the database so - no, there's no extra security, whichever solution you choose. Concerning the last question, it's very easy for a shell script to grab a password from a php configuration file (hint: grep and sed are your friends here), so you don't have to modify in a lot of places. Concerning php versus shell - the cli of php does pretty well, the only difference is that you may have to write larger amounts of code in php for the same thing where shell scripting would fit in one line.

share|improve this answer
1  
in adition to this.. NEVER use a privileged user to do backups task in MySQL. instead create a new user with backup privileges only –  Luciano Facchinelli Aug 21 '11 at 16:47

Write the script as root, put the password into root's .my.cnf (with permissions 600). You can then run mysql commands without ever having to pass the password.

I can hear a million people screaming already - but my logic is simple. If someone breaks into your server and manages to escalate their privileges to root, you've already lost and they already have access to everything.

If only root can read .my.cnf then it's as secure as putting a password into any other file, but it means you never run scripts passing the password on the command line which can be read by any user using ps -ef.

share|improve this answer
    
Anyone who screams at your suggestion doesn't know what they're talking about. It's the best possible method. –  womble Aug 22 '11 at 0:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.