I see these when running MySQLTuner.pl:

-------- Security Recommendations  -------------------------------------------
[!!] User '@debian' has no password set.
[!!] User '@localhost' has no password set.
  • Is it a security hole?
  • How to fix it?


1 Answer 1


That is definite a security hole. That's because mysql was installed that way.

To remove those entries, please run these lines

DELETE FROM mysql.user WHERE user='' or password='';

Here are three(3) past posts I wrote on how and why to do such cleanup of mysql.user and mysql.db

  • 1
    Great answer, just a typo FLUSH PRIVILEGES: should be FLUSH PRIVILEGES; with semicolon. I copy-pasted and got an error, so tried to edit the answer but I was not allowed as it is not a 6+ chars edit...
    – Nicolas S
    Sep 30, 2013 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.