Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

344

|

Chapter 10: Securing Web Servers

Accessing Databases

Although relational databases have standardized on SQL as a query language, many

of their APIs and interfaces, whether graphic or text based, have traditionally been

proprietary. When the Web came along, it provided a standard GUI and API for

static text and dynamic applications. The simplicity and broad applicability of the

web model led to the quick spread of the Web as a database frontend. Although

HTML does not offer the richness and performance of other graphical user inter-

faces, it’s good enough for many applications.

Databases often contain sensitive information, such as people’s names, addresses,

and financial data. How can a porous medium like the Web be made safer for data-

base access? Here are some guidelines for Web-MySQL access (some are also dis-

cussed in Chapter 8):

• Don’t have your database on the same machine as the web server. It’s best if

your database is behind a firewall that only passes queries from your web server.

For example, MySQL normally uses port 3306, so you might only permit access

from ports on the web server to port 3306 on the database server.

• Check that all default database passwords have been changed. For MySQL,

ensure that the default user (called root, but not related to the Unix root ...