Mac® Security Bible

18.5. Database Security

The previous section covered injection attacks, one of the ways in which database servers are often compromised. But SQL servers are designed to operate over a network, and there's usually no expectation at all that a database resides on the same computer as a web server that uses it to store data or a client that connects for administrative purposes. Therefore, if you plan to administer your SQL server from a computer other than the one it's running on or use its data to feed a web server on another computer, you should take a few additional steps to prevent unauthorized users from getting administrative access to your database:

• Customize firewall rules. Although you can administer an SQL database from the command line using Terminal (either locally or over SSH), many people prefer a friendlier, fill-in-the-blanks interface. Some of the tools that offer this capability are conventional Mac OS X GUI programs — for example, MJ Media's free Sequel Pro (www.sequelpro.com) or Araelium Group's $25 Querious (www.araelium.com/querious/). For such applications, which communicate directly over the Internet, make sure the firewall on the Mac running your SQL server has the necessary port(s) open to enable you to access it from another computer. Or, for better security, configure the firewall to restrict incoming access on the designated ports to only those IP addresses that need it. By default, MySQL uses port 3306, whereas PostgreSQL uses port 5432. If you use a ...