Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And m

Question

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure?

The background for my question is: I want to get rid of having to manage all the database user passwords used by various web applications when accessing MySQL and PostgreSQL databases. In all cases when the DB and the App(s) are on the same host, domain socket authentication seems to be the best way to connect them, assuming that each app runs as a separate user.

This mechanism however seems to be very rarely used. Most web apps provide installation instructions proposing password authentication, most linux distributions use passwords by default (infamous MySQL root password) even if DBs are preconfigured for local access only.

I wonder whether there is a good reason to stick to passwords which seems to have only disadvantages (if you impersonate as the user you get their password from the config files and can then access the database without having to re-gain access to the user account).

Explanation / Answer

The MySQL SO_PEERCRED authentication is fairly recent, it was added in version 5.5.10, March 2011. The similar Postgres authentication is a lot older. (Note that Postgres also supports ident, RFC 1413, authentication; MySQL does not, that would be another plugin, perhaps someone will write it.) The relative newness of the feature in MySQL would be one reason you don't see a lot of web apps using it.

The other reason is that, once the app gets enough use, the first thing you'll do for performance or reliability is to move the database to a different host, whereupon you'll have to set up a password (or some other method of authentication) anyway.

As far as security, however, I would say this method is very secure. It depends on the kernel for the security guarantee, that's all.

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.