Image retained from the original article.
Originally published 21 July 2023; rewritten and reviewed on 15 October 2026.
A database connection works immediately when supplied with an administrator account. That convenience can conceal a design problem: the application now has authority far beyond the queries it needs. I would treat its identity as a central part of hardening.
Start with access paths and ownership
Record which applications and operators need database access, from which networks and for which purposes. Restrict listening interfaces and firewall access to those requirements. Confirm that legitimate backup, monitoring and administration still work after a change.
Keep the database on a supported release and plan updates around compatibility testing and verified recovery. The version numbers in the original 2023 article were historical examples, not a current release recommendation.
Grant the application’s actual operations
Use a dedicated application identity rather than the root account. The exact privileges depend on whether the service reads data, writes records or performs migrations. Separate schema-changing deployment work from ordinary request processing where practical.
-- Review the effective permissions for a known application account.
SHOW GRANTS FOR 'app_user'@'app_host';
Replace the account and host with an existing identity you are authorised to inspect. Do not copy a broad grant merely because it makes an access error disappear. Review TLS and client certificate requirements according to the deployed environment.
Include the data lifecycle
Encrypt and control access to backups appropriately, retain the records required by the business and test restoration. Establish who reviews unusual access and how logs are protected. Avoid writing database passwords into source code, diagnostic output or published examples.
A hardened database should remain operable. Test the application, migrations and recovery with the intended accounts, then record the results. The most useful outcome is a permission model the team can explain and maintain, rather than a collection of settings copied from another server.