Storing MariaDB Credentials Securely: Why `mysql_config_editor` is Not the Answer

• MySQL's mysql_config_editor:
  • This utility allows saving credentials (username, password) in an obfuscated file (.mylogin.cnf).
  • While it offers some protection, it's not considered truly secure. Hackers with access to your system could potentially retrieve the password.
  • MariaDB (a MySQL derivative) does not support mysql_config_editor due to these security concerns.

MariaDB Approach:

• MariaDB recommends a more secure approach:
  • Explicitly provide credentials when connecting to the database server through command-line tools or applications.
  • This avoids storing passwords in plain text or obfuscated files.

Alternative for Repeated Connections (Optional):

• If you frequently connect to the same MariaDB server from the command line, consider creating a configuration file:
  1. Create a file (e.g., .my.cnf) in your home directory.
  2. Add connection details in INI format (e.g., user = your_username, password = your_password).
  3. Use the --defaults-file option with the mysql command-line tool to reference this file (e.g., mysql --defaults-file=.my.cnf).

Important Security Practices:

• Strong Passwords: Always use strong, unique passwords for your MariaDB accounts.
• Limited Access: Grant database access only to authorized users with the minimum privileges they need.
• Regular Reviews: Periodically review user privileges and access levels.
• Secure File Permissions: If you choose to use a configuration file, ensure its permissions are set to restrict access only to the user who owns it.

In Summary:

• MariaDB prioritizes security by not offering an equivalent to mysql_config_editor.
• Explicitly providing credentials is the most secure approach.
• For repeated connections, you can create a configuration file with proper security measures.
• Always adhere to strong password practices and user access control.

import mariadb

try:
    conn = mariadb.connect(
        host="your_host",
        port=3306,  # Default MariaDB port
        user="your_username",
        password="your_strong_password",
        database="your_database"
    )

    cursor = conn.cursor()
    cursor.execute("SELECT * FROM your_table")
    result = cursor.fetchall()

    # Process your results here
    print(result)

except mariadb.Error as err:
    print(f"Error connecting to MariaDB: {err}")

finally:
    if conn:
        conn.cursor().close()
        conn.close()

Configuration File (Optional, with Security Measures):

# Create a file named ".my.cnf" in your home directory (Linux/macOS)
# Make sure file permissions are set to restrict access (e.g., `chmod 600 ~/.my.cnf`)

[client]
host = your_host
port = 3306
user = your_username
password = your_strong_password
database = your_database

import mariadb

try:
    conn = mariadb.connect(
        defaults_file="~/.my.cnf"  # Path to your configuration file
    )

    cursor = conn.cursor()
    cursor.execute("SELECT * FROM your_table")
    result = cursor.fetchall()

    # Process your results here
    print(result)

except mariadb.Error as err:
    print(f"Error connecting to MariaDB: {err}")

finally:
    if conn:
        conn.cursor().close()
        conn.close()

Remember:

• Replace placeholders like "your_host", "your_username", "your_strong_password", and "your_database" with your actual details.
• For the configuration file approach, ensure the file permissions are set to restrict access only to you (e.g., chmod 600 ~/.my.cnf). This helps prevent unauthorized access even if someone gains access to the file content.

• Set environment variables on your system to hold database credentials.
• Access these variables within your application to connect to MariaDB.

Example (Python):

import os
import mariadb

try:
    host = os.environ.get('DB_HOST')
    user = os.environ.get('DB_USER')
    password = os.environ.get('DB_PASSWORD')
    database = os.environ.get('DB_NAME')

    conn = mariadb.connect(
        host=host,
        user=user,
        password=password,
        database=database
    )

    # ... (rest of your code)

except mariadb.Error as err:
    print(f"Error connecting to MariaDB: {err}")

finally:
    if conn:
        conn.cursor().close()
        conn.close()

Security Concerns:

• Environment variables can be viewed by processes running on the same system. Hackers with access to your system could potentially retrieve the password.
• Not ideal for production environments due to the inherent risk.

Key Management Systems (External Solution):

• Leverage a dedicated Key Management System (KMS) to store and manage database credentials securely.
• Applications retrieve credentials from the KMS at runtime using secure protocols.

Security Benefits:

• Provides a more robust solution for credential storage outside the database itself.
• KMS can offer additional security features like access control and audit logging.

Drawbacks:

• Requires setting up and managing a separate KMS system.
• Introduces additional complexity to your application architecture.

Password Hashing with User Input (Limited Use Cases):

• Store password hashes in the database, not the actual passwords.
• When a user attempts to log in, hash their input password and compare it to the stored hash.

• While storing hashes is more secure than plain text passwords, attackers might still be able to crack weak hashes using brute force methods.
• Requires implementing secure hashing algorithms and proper salting techniques.
• This approach is generally not recommended for primary authentication due to its complexity and potential for vulnerabilities. It might be suitable for specific use cases where additional security layers are in place for user authentication (e.g., two-factor authentication).

• The most secure approach is to avoid storing passwords in the database altogether. Use one of the first two methods (explicit credentials or configuration file with strong security) for the best balance of security and practicality.
• Key Management Systems offer a more robust solution but add complexity.
• Use password hashing with caution and only in specific scenarios where additional security measures are implemented.