Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security checklist: DB "operations needed" #2356

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Security checklist: DB "operations needed" #2356

Changes from 8 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
dea188f
Security checklist: File system permissions
glye Apr 8, 2024
20063ff
security_checklist.md: Restricted DB user w/ example
adriendupuis Apr 8, 2024
0533601
Apply suggestions from code review
adriendupuis Apr 8, 2024
58012d2
Review feedback
glye Apr 8, 2024
b3d0189
Update docs/infrastructure_and_maintenance/security/security_checklis…
adriendupuis Apr 9, 2024
4501d4c
Grammar
glye Apr 9, 2024
ead05a1
Merge branch 'checklist-file-system-permissions' into checklist-db
adriendupuis Apr 9, 2024
9402cab
security_checklist.md: Format
adriendupuis Apr 9, 2024
abe2e28
Merge branch 'master' into checklist-db
adriendupuis Jun 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion docs/infrastructure_and_maintenance/security/security_checklist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,32 @@ The older UTF8 can lead to truncation with 4-byte characters, like some emoji, w

See [Change from UTF8 to UTF8MB4](update_db_to_2.5.md#change-from-utf8-to-utf8mb4).

### Use restricted DB user

The Data Definition Language (DDL) commands (create, alter, drop, truncate, comment) are only needed for installing and upgrading [[= product_name =]], and not for running it.
Not granting these rights to web app users reduces the damage that can result from a security breach.

Create a user and grant minimal rights:

=== "MySQL"

```sql
CREATE USER 'user'@'host' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE, DELETE ON database_name.* TO 'user'@'host';
Copy link
Contributor

@glye glye Apr 9, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't we need TCL commands here, too? BEGIN START TRANSACTION, COMMIT, ROLLBACK, SET at least?

Copy link
Contributor Author

@adriendupuis adriendupuis Jun 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I may have misinterpreted your remark at first. I thought it was about wrapping the commands in a transaction batch.

SET could be added in PostgreSQL: https://www.postgresql.org/docs/current/sql-grant.html#SQL-GRANT-DESCRIPTION-OBJECTS

I see no equivalent on MySQL: https://dev.mysql.com/doc/refman/8.4/en/privileges-provided.html

Comment on lines +153 to +154
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
CREATE USER 'user'@'host' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE, DELETE ON database_name.* TO 'user'@'host';
START TRANSACTION;
CREATE USER 'user'@'host' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE, DELETE ON database_name.* TO 'user'@'host';
COMMIT;

```

=== "PostgreSQL"

```sql
CREATE USER user PASSWORD 'password';
GRANT CONNECT ON DATABASE database_name TO user;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO user;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO user;
Comment on lines +160 to +163
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
CREATE USER user PASSWORD 'password';
GRANT CONNECT ON DATABASE database_name TO user;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO user;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO user;
BEGIN;
CREATE USER user PASSWORD 'password';
GRANT CONNECT ON DATABASE database_name TO user;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO user;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO user;
COMMIT;

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
CREATE USER user PASSWORD 'password';
GRANT CONNECT ON DATABASE database_name TO user;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO user;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO user;
CREATE USER user PASSWORD 'password';
GRANT CONNECT ON DATABASE database_name TO user;
GRANT SET, SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO user;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO user;

```

In configuration, update users and passwords, such as [`DATABASE_URL`](install_ibexa_dxp.md#change-installation-parameters)
or a [connection](repository_configuration.md#defining-custom-connection).

### Use secure Roles and Policies

Use the following checklist to ensure the Roles and Policies are secure:
Expand Down Expand Up @@ -190,7 +216,11 @@ Once you have properly configured secure user roles and permissions, to avoid ex

- Avoid exposing servers on the open internet when not strictly required.
- Ensure any servers, services, ports and virtual hosts that were opened for testing purposes are shut down before going live.
- Secure the database with a good password, keys, firewall, etc. Ensure that the database user used by the web app only has access to do the operations needed by [[= product_name =]]. The Data Definition Language (DDL) commands (create, alter, drop, truncate, comment) are not needed for running [[= product_name =]], only for installing and upgrading it. If the web app user does not have these rights, then that reduces the damage that can be done if there is a security breach.
- Ensure file system permissions are set up such that the web server or PHP user can't access files they shouldn't be able to read.
- Secure the database with a good password, keys, firewall, etc.
Optionally, [restrict the database user](#use-restricted-db-user) to the needed operations.

Those steps aren't needed when using [[= product_name_cloud =]], where the provider handles them.

### Security headers

Expand Down
Loading