Secure backup using Mysql and C#

Question

My application is C# and BD is Mysql, when I do the backup he creates a arquivo.sql. That one arquivo.sql can be easily edited in a notepad, or any other editor, thus leaving my comic very truthful, as I can do so that nobody edits my BD and that only the user register for me on the server can open this backup.

Follows the line of backup Mysql I use in C#

public void Backup(string Caminho) //Backup a MySQL database
    {
        string constring = _StringConexao;
        string CaminhoBackup = Caminho + "\\databases.sql";
        using (MySqlConnection conn = new MySqlConnection(constring))
        {
            using (MySqlCommand cmd = new MySqlCommand())
            {
                using (MySqlBackup mb = new MySqlBackup(cmd))
                {
                    cmd.Connection = conn;
                    conn.Open();
                    mb.ExportToFile(CaminhoBackup);
                    conn.Close();
                }
            }
        }
    }

Answer 1

Your database won’t be vulnerable because of this. The database and this file with its SQL code are different and unrelated.

You want to protect the backup so that no one moves? Do not give access to it to any user. Do not expose this possibility in the application. This is the correct way to do this.

If the database is on a protected server, do the routine that generates the backup run only on this server. If you schedule a task.

If the database is not on an isolated server without users' access, then you are already in much bigger trouble than protecting the backup.

If you insist on backup on the client, even if it comes from a protected server, doesn’t it have other vulnerabilities? There is no point in worrying about protecting something secondary if the main one has problems. And it is very common to have problems. People who aren’t security experts tend to miss a lot of things that aren’t obvious. In general they end up causing no problems if you are in a more controlled environment (internal).

If you think you still have to do this, you can use encryption builtin of the class you are using.

using (MySqlConnection conn = new MySqlConnection(connectionString))
using (MySqlCommand cmd = new MySqlCommand())
using (MySqlBackup mb = new MySqlBackup(cmd)) {
    cmd.Connection = conn;
    conn.Open();
    mb.ExportInfo.EnableEncryption = true;
    mb.ExportInfo.EncryptionPassword = "qwerty";
    mb.ExportToFile(@"C:\backup.sql");
}

I put in the Github for future reference.

See the documentation.

This example also shows the correct way to use the connection. No need to close. It closes by itself.

If someone has access to the password and this is easier than it seems they may have access to the information.

Now the language lets you write like this:

using var conn = new MySqlConnection(connectionString));
using var cmd = new MySqlCommand());
using car mb = new MySqlBackup(cmd));
cmd.Connection = conn;
conn.Open();
mb.ExportInfo.EnableEncryption = true;
mb.ExportInfo.EncryptionPassword = "qwerty";
mb.ExportToFile(@"C:\backup.sql");