Ruby on Rails Security Project

Follow-up of your comments:

Dan Kubb has some interesting comments about the OS security, and uses MySQL in a strict mode by using the sql-mode directive in my.cnf:
sql-mode = ansi,traditional,no_engine_substitution,
no_auto_value_on_zero,no_dir_in_create,
no_unsigned_subtraction
And, yes, the MySQL user I’m creating is only for “normal” Rails access, not for db migration or testing. I agree, Rails/Rake should provide means to use […]

Bookmark to

[Read more →]

Rails’ database connection
We have to update Rails’ database configuration in the project’s config/database.yml file. We have to enter both, the user name and password in the clear, so it is good advice to protect the file from unauthorized reading.
Encryption
Both, in MySQL and Rails (plugins), there are means to encrypt data. In MySQL, you can use […]

Bookmark to

[Read more →]

Many Rails setups use MySQL as back-end storage. So let’s set up a secure MySQL server, which will run on the same machine as Ruby on Rails and the web server. In the following we will be using MySQL version 5.0 on a Unix system.
Users
Before starting to secure MySQL, we have to install it, and […]

Bookmark to

[Read more →]