Database Security Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

An account is a person or an application, not a shared superuser

Database security here is who may connect and what they may touch. The grant builder drafts a statement. The least-privilege checker asks whether that draft is wider than the job. A draft that grants everything is a draft you delete. The tools do not log into the database.

The application has its own account. People have their own accounts. Nobody uses the superuser for the application, and nobody shares a password in a chat. The password in any note is prompt-for-this. The real value is in the store.

The lab listens on localhost. A database opened to every address because a laptop could not connect is the mistake the configuration guide also refuses. The host firewall belongs to the security desk's hardening guide. This page is the account and the grant.

A right you cannot explain is a right you do not grant. Read, write, and admin are different. An account that only reads does not get a drop. An account that loads a file does not get every table.

One lab account, one table, one refused grant

Create a lab account with a password you type at a prompt, not a password you paste into the ticket. Grant it select on one lab table. Connect as that account. The select works. A drop or a read of another table fails. Write both results.

Run the checker on the grant text. If it says the grant is wider than the sentence in the ticket, narrow the grant and try again. Do not silence the checker by granting more.

List the real accounts you already have, by name, without passwords. Any shared admin login is a gap with an owner. You do not fix every account today. You name the gap.

Connection strings belong to the connections guide. They do not carry the password into git. This page stops when the lab account can do its job and cannot do the next job.

A change you can finish

Production gets one new application account, or one narrowed grant, after the lab pair of success and failure. A review of every account is the audit guide's list, not this hour.

Rollback is revoking the new grant or disabling the new account, which you do once on the lab so the statement is real.

Name the job the account will do, in one sentence.
Create it on the lab. Keep the password out of the ticket.
Grant only that job.
Prove the job works and a wider job fails.
Refuse any grant of everything.
Confirm the listener is localhost on the lab.
Write the revoke statement and try it once.

Mistakes that outlive the command

database security fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

The application logging in as the superuser.
A shared password.
A grant of all rights because the error was annoying.
A password in the ticket, the wiki, or git.
Opening the listener to every address to finish the test.
Using a real person's data to prove a select.
Disabling the failure test because it failed.
A checker result you ignored.
Changing host firewall rules in the same window.
No revoke statement.

Decisions to write down before the window

One decision for database security: The account's job fits in one sentence. It is not a superuser. The password is not in the ticket. The grant matches the sentence. A wider action failed on purpose. The lab listens on localhost. The checker was read. Rollback is a revoke you have run. The connections guide owns the string. The audit guide owns the full account list. The host hardening guide owns the firewall. And one account is this window.

The hour you stop

Write the database name, the host, and the clock time before you change anything for database security. If this database is serving people and you do not have a copy, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a restored copy. The rows you read are rows you are allowed to hold. You do not point a client at a database, a cluster, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a connection string, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A config line, an index, a grant, and a restore do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file or the backup you already tested.

A second person reads the scope aloud: which host, which database, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

The lab listens on localhost. 127.0.0.1 is the address you bind until a firewall story exists. example.com is not your host. A generated file that listens on every address is a file you edit before it runs.

Do not run a statement you cannot undo. A delete or a drop without a backup and a where-clause you have read is the mistake this page is here to prevent. Read the statement. Count the rows it will touch. Then decide.

Keep the previous config and the previous dump. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the reload with a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a database nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next database waits until someone else can repeat the proof from the notes. database security is done for this window when the proof is written, not when the client printed a prompt.

This page is a planning guide. It is not a vendor manual, not an official standard, and not legal advice. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this database alone until that guide has its own window.

Database security checks before the account is used by an application

Confirm this before you call the change done: The account name matches the job. A select or the job's statement works. A wider statement fails. No superuser flag is set on that account. prompt-for-this is not the live password. The listener is localhost on the lab. The grant text is in the ticket. The revoke was tried. No customer row was required for the proof. A second person read the grant. Git does not contain the password. Other accounts were listed, not all changed. The hostname in the prompt matches the hostname in the ticket for database security. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for database security happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.

Companion: Security: Server Hardening Guide.