Security concern between application server and database server

Question

Think about the situation like this.... I have an application server, and a database server. An application will ask for database server information. The database server, of course, need a password. Also, having a SSL connection. Is it necessary to make the connection via a VPN network ? Also, I am using RoR to develop, is there any way to protect database.yml ?? thank you.

Answer 1

"Standard" practice is to make sure the database server is not open to the internet at large. Ideally, the database should only permit connections from the app server - a connection on the local network, locked to a specific port and IP address. You don't really need SSL in this case as the environment is trusted.

Regardless of your framework or language, there is no real way to protect the database configuration on the app server outside of your normal access policies. Lock the server down, lock the database permissions as much as you can (restrict to SELECT UPDATE DELETE etc on specific tables as your use-cases permit.