different mysql users for Joomla backend and frontend for the sake of more security

242 views Asked by At

I currently have just the basic privileges set to joomla’s mysqluser: INSERT, UPDATE, DELETE and SELECT.

But in fact if the this user is being used across the entire site, if any hacker finds a way to get it or to control the queries (sql injection) he will be able to delete the entire content of a website.

My idea would be to have 2 different mysql users in joomla. One to user in the frontend and the other one to be used in the backend (/administrator). In fact the administrator will require the privileges I currently use, but the frontend user will only require SELECT and a few UPDATE and INSERT previligies to some particular tables like banners and session

I know it might sound paranoid, but currently the projects I'm working with require this kind of "paranoid" approach.

I expact any Joomla experts will help me in achieving this.

1

There are 1 answers

0
Lodder On

Firstly, I have seen that you used the Joomla 1.7 tag in your question, but please ensure you are running the latest version of the Joomla 2.5 series, 2.5.9

What you are trying to achieve from what I have read is you want 2 users, 1 that can only log into to the frontend and the other that can log in to the backend. This currently is available in Joomla and would require core code changes which I'm not going to recommend you do. Have a read through another question I answered, giving information and good extensions to help with security.

Joomla! 2.5.4 Hacked: Having trouble with diagnosis

Then, simply create a separate admin account and only use that one to login to the backend.