Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have been looking all over the web now, and can not seem to find the option to disable this command. I think this is quite a risky security hole.

There is an option to disable SHOW DATABASES; , but not SHOW TABLES;

Maybe some of you had

share|improve this question
3  
Why on earth is it a "risky" security hole? –  Phil Jan 28 '13 at 12:04
    
@Phil, one would see those table anyway where he has read access. –  Michael-O Jan 28 '13 at 12:11
    
Well the way I think, if someone makes an SQL injection to your application, he might find entire structure of database from show tables. if he just makes injection, he will still need to guess table names. –  Katafalkas Jan 28 '13 at 13:31
    
or am I just nuts ? :) –  Katafalkas Jan 28 '13 at 13:32
    
Maybe just adjust the permissions of the application user that queries the database? And let it just read/write to the correct tables and revoke any unneeded permissions. It's just a thought, I'm not very familiar with MySQL security concepts, but shouldn't be too different from other RDBMSs.. –  Marian Jan 28 '13 at 13:51

1 Answer 1

up vote 4 down vote accepted

As far as I know you cannot disable SHOW TABLES, but if you have only assigned permissions to tables that the user should be able to access, I don't see how there is a security issue. A user cannot list tables to which he has no permissions.

root@beren [~]# mysql -u root -p
Enter password:

<-- SNIP -->

mysql> use foo;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> show tables;
+---------------+
| Tables_in_foo |
+---------------+
| bar           |
| baz           |
+---------------+
2 rows in set (0.00 sec)

mysql> create user 'quux'@'localhost' identified by '*******';
Query OK, 0 rows affected (0.00 sec)

mysql> grant select on table foo.bar to 'quux'@'localhost';
Query OK, 0 rows affected (0.00 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.02 sec)

mysql> exit
Bye
root@beren [~]# mysql -u quux -p foo
Enter password:

<-- SNIP -->

mysql> show tables;
+---------------+
| Tables_in_foo |
+---------------+
| bar           |
+---------------+
1 row in set (0.00 sec)

mysql>
share|improve this answer
    
Cheers for reply. –  Katafalkas Jan 28 '13 at 15:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.