Database Security Hardening: PostgreSQL, MySQL, MongoDB, and Redis

Database Security Fundamentals

Databases contain your most valuable data, and they're a prime target for attackers. Whether it's SQL injection leading to data exfiltration or misconfigured access controls exposing sensitive records, database security requires dedicated attention.

PostgreSQL Hardening

Authentication

# pg_hba.conf - Require SSL and strong authentication
hostssl all all 0.0.0.0/0 scram-sha-256
# Disable trust and md5 authentication

Access Control

-- Principle of least privilege
REVOKE ALL ON DATABASE production FROM PUBLIC;
GRANT CONNECT ON DATABASE production TO app_user;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO readonly_user;

Encryption

# postgresql.conf
ssl = on
ssl_cert_file = '/etc/ssl/certs/server.crt'
ssl_key_file = '/etc/ssl/private/server.key'
ssl_min_protocol_version = 'TLSv1.2'

Audit Logging

log_connections = on
log_disconnections = on
log_statement = 'ddl'
log_line_prefix = '%t [%p] %u@%d '

MongoDB Hardening

Authentication and Authorization

// Enable authentication
use admin
db.createUser({
    user: "admin",
    pwd: "strong_password",
    roles: [{role: "userAdminAnyDatabase", db: "admin"}]
})
// mongod.conf: security.authorization: enabled

Network Security

# mongod.conf
net:
  bindIp: 127.0.0.1,10.0.0.5  # Not 0.0.0.0
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem

Encryption at Rest

security:
  enableEncryption: true
  encryptionKeyFile: /etc/mongodb/encryption-key

Redis Hardening

# redis.conf
requirepass strong_password
bind 127.0.0.1
rename-command FLUSHALL ""
rename-command CONFIG ""
rename-command DEBUG ""

Universal Best Practices

Never expose databases directly to the internet
Use connection pooling with credential rotation
Enable audit logging for all data access
Implement column-level encryption for sensitive fields
Regular backup testing and verification
Patch databases within SLA timelines

SuperClue Database Module

SuperClue's database configuration module checks from outside whether database ports are exposed to the internet. It does not log in to your databases to review their settings, so use the hardening steps above for that.