Mysql – What exactly do database passwords protect

MySQLphpmyadmin

I would like to know what exactly I am password protecting on my server when I set a database password. I am unclear as to what people are referring to when saying to password protect a database. Are they referring to a single specific database or do they mean the complete mysql database structure located on the server. The reason I ask is because, when I set a password, it is only one password for all my databases that I'm managing in phpMyAdmin. So when I'm required to enter the password in my config file in codeigniter, it is always the same one for all my different databases that I'm using. Is the password that I'm required to enter in order to even get phpMyAdmin started the Database Password which people refer to, or can I (and should I) set different passwords for my seperate Databases?

Best Answer

The passwords you're talking about are passwords for MySQL users. You don't really set a password for a database or table. You can effectively implement different passwords for different DBs by creating multiple users with different passwords and only granting access to specific databases for each user. When people say that you should set a password for the database, they probably mean that you shouldn't use users with no password, which is possible, but shouldn't be done due to the obvious security concerns.

Whether or not you "should" use multiple users depends on your situation. If you have multiple databases that are used by independent applications, it is a good idea to create a user for each application to help isolate any risks from spreading between applications via the database. If you have one database that is used by different applications, you can use different users to help track stuff or lock down permissions. If you have on application, you're generally safe with using just one user.

The main reason to use different users is to lock down permissions and prevent any errors/attacks from causing too much damage. If you're performing a task that only needs to read data, using a user that only has SELECT permissions can prevent accidental deleting or modifying of data; even though the risk of such an event is very low, it is still good to have something to prevent it. Using different users is usually only helpful when all of the users would see significant use. In your situation, you could use multiple users, but it would probably become more of a nuisance for you to keep track of when you would use which user and which user is currently connected.

Related Question