DependencyTrack / DependencyTrack/dependency-track
Allow (or document if I missed something) running of DT with minimal database privileges
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Looking through the documentation of the database connection settings and the information in [this old comment](https://github.com/DependencyTrack/dependency-track/issues/207#issuecomment-427377083) it appears to me that DT must be run with a highly privileged database user in order to execute DDL statements against the database for creating (and modifying) the database schema.
### Proposed Behavior
I expect DT to allow for running DDL statements with a separate privileged user on startup (alternatively provide a way to manually apply the schema outside of application lifecycle) then use a less priviledged user for regular operations.
As to why, this would be to adhere to OWASP recommendations for database access
> * Only grant the required permissions on the databases.
> * Most applications would only need SELECT, UPDATE and DELETE permissions.
> * The account should not be the owner of the database as this can lead to privilege escalation vulnerabilities.
Source: https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html#permissions
> Accounts with db_owner equivalent privileges such as schema modification or unlimited data access typically have far more access to the database than is required to implement application functionality. Web applications should use one or more lesser-privileged accounts that are prevented from making schema changes or sweeping changes to or requests for data.
Source: https://owasp.org/www-community/Access_Control
As an example of how this could look, in the Spring Boot + Liquibase ecosystem there are config parameters for an extra, single thread, thread pool exclusively for running migrations (with fallback to the primary connection pool details if not configured) e.g. https://gitlab.com/sharebear/spring-postgresql-hardening/-/blob/main/jdbcplayground/src/main/resources/application-v3.yaml
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.