# Database.yml password and security

**URL:** <https://www.ruby-forum.com/t/database-yml-password-and-security/157131>\
**Category:** Rails\
**Created:** [January 7, 2009, 5:17pm UTC](https://www.ruby-forum.com/t/database-yml-password-and-security/157131 "2009-01-07T17:17:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pikz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/45deac/32.png) [@pikz](https://www.ruby-forum.com/u/pikz)\
**Post date:** [January 7, 2009, 5:17pm UTC](https://www.ruby-forum.com/t/database-yml-password-and-security/157131/1 "2009-01-07T17:17:49Z")

</div>

I would like to ask if it’s less secure to grant all privileges in  
MySQL to the user running the application, instead of having the  
password in the database.yml file?

---

<div class="post-metadata">

**Author:** ![pikz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/45deac/32.png) [@pikz](https://www.ruby-forum.com/u/pikz)\
**Post date:** [January 7, 2009, 9:16pm UTC](https://www.ruby-forum.com/t/database-yml-password-and-security/157131/2 "2009-01-07T21:16:21Z")

</div>

pikz wrote:

> I would like to ask if it’s less secure to grant all privileges in  
> MySQL to the user running the application, instead of having the  
> password in the database.yml file?

I don’t understand this question. The database.yml file specifies both  
the mysql user and the password for the specified user used to connect  
to the database.

I think what you’re getting at is whether to put the literal password in  
the database.yml file or store the password separately in a file, which  
is then stored in a secure location. Then reference that file to get the  
password. This is often done for the :production settings in the  
database.yml file.

If I remember right this Railscasts episode shows how to do this:

> **[\#85 YAML Configuration File - RailsCasts](http://railscasts.com/episodes/85-yaml-configuration-file)**
>
> Short Ruby on Rails screencasts containing tips, tricks and tutorials. Great for both novice and experienced web developers.

---

<div class="post-metadata">

**Author:** ![pikz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/45deac/32.png) [@pikz](https://www.ruby-forum.com/u/pikz)\
**Post date:** [January 8, 2009, 9:41am UTC](https://www.ruby-forum.com/t/database-yml-password-and-security/157131/3 "2009-01-08T09:41:31Z")

</div>

hi,

Preferrable, give only required access to the user but with a password  
from  
MYSQL and use it with the password specified in the database.yml file.  
You  
can use the security feature for mentioning your username and password  
as  
mentioned by Robert

Regards,  
NAYAK

On Thu, Jan 8, 2009 at 1:46 AM, Robert W. \<