Securityintermediate

Database Authentication

Choosing an authentication method per engine, eliminating shared accounts, and the defaults that must be changed.

2 min readIntermediateUpdated 31 Jul 2026Edit this page

Authentication answers who is connecting. Getting it wrong is the most direct route to a data breach, and the defaults of most engines are chosen to make the first connection succeed rather than to be safe.

Methods

Method	Use for
Password (SCRAM, `caching_sha2_password`)	Application accounts, when nothing better is available
Client certificates (mTLS)	Service-to-service where certificates are already managed
IAM / cloud identity	Managed services; short-lived, centrally revocable credentials
Kerberos / LDAP	Enterprise environments with existing directory infrastructure
Peer / socket	Local administrative access on the database host

PostgreSQL

# pg_hba.conf — first matching line wins; there is no catch-all here by design.
local   all          postgres                      peer
hostssl shop         app_service   10.20.0.0/24    scram-sha-256
hostssl replication  replicator    10.20.1.10/32   scram-sha-256

-- Verify the rules loaded as intended.
SELECT line_number, type, database, user_name, address, auth_method
FROM pg_hba_file_rules WHERE error IS NULL;
 
-- Confirm password encryption.
SHOW password_encryption;   -- scram-sha-256

MySQL / MariaDB

CREATE USER 'app_service'@'10.20.0.%'
  IDENTIFIED WITH caching_sha2_password BY :'password'
  REQUIRE SSL;
 
-- Find accounts that should not exist.
SELECT user, host, plugin FROM mysql.user WHERE user = '' OR host = '%';

Empty usernames are anonymous accounts; host = '%' allows connection from anywhere. Both should be absent in production.

Redis / Valkey

requirepass <long-random-secret>
 
# Better: ACL users with scoped permissions.
ACL SETUSER app on >secret ~shop:* +@read +@write -@dangerous
ACL LIST

protected-mode must remain on, and the instance should bind to a private interface only.

MongoDB

use admin
db.createUser({
  user: "app_service",
  pwd: passwordPrompt(),
  roles: [ { role: "readWrite", db: "shop" } ]
});

Authentication must be explicitly enabled (security.authorization: enabled); an instance started without it accepts every connection as an administrator.

Practices

One account per service. A shared account cannot be revoked without affecting everyone, and audit logs cannot attribute actions to anyone.
No human uses an application account. Human access is separate, audited, and preferably short-lived.
Prefer short-lived credentials. IAM authentication or a vault issuing temporary passwords limits the value of a leak to its lifetime.
Restrict by source address as well, so a stolen credential is not usable from anywhere.
Alert on authentication failures, which reveal both misconfiguration and brute-force attempts.