4

On a MySQL 5.6 server, the mysql.user table contains an user with an empty hostname ('jdoe'@''). What does that mean?

5
+50

User whose name is joe can connect from any host.

Please note what MySQL 5.0 Certification Study Guide

enter image description here

say in its bulletpoints on Page 498 Paragraph 6:

On Unix, MySQL comes with a mysql_secure_installation script that can perform several helpful security-related operations on your installation. The script has the following capabilities:

  • Set a password for the root accounts
  • Remove any remotely accessible root accounts.
  • Remove the anonymous user accounts. This improves security because it prevents the possibility of anyone connecting to the MySQL server as root from a remote host. The results is that anyone who wants to connect as root must first be able to log in on the server host, which provides an additional barrier against attack.
  • Remove the test database (If you remove the anonymous accounts, you might also want to remove the test database to which they have access).

That user needs to be removed immediately.

Simply run

DELETE FROM mysql.user WHERE host='';
FLUSH PRIVILEGES;

GIVE IT A TRY !!!

UPDATE 2017-02-01 17:07 EST

According to the MySQL Documentation on Access Control, Stage 2: Request Verification

A '%' or blank Host value means “any host.”

This is applicable at all levels of grants.

1
  • Think Ronaldo try to put as much information as he can :-) and forget change wrong part :-) -" User can connect from any host whose name is jdoe". Correct form - user jdoe, can connect from any host. – a_vlad Feb 1 '17 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.