0

I have mysql-server-5.5 in Ubuntu Server 12.04

I realized that when typing mysql command logged as any system user I got access to mysql, despite I can only display test and information_schema databases, how can I disable this accesses?

I don't have those users registered on mysql so I don't want this to have access.

This is what happens

user-one@server:~$ mysql
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 39950
Server version: 5.5.38-0ubuntu0.12.04.1-log (Ubuntu)...

mysql> SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| test               |
+--------------------+
2 rows in set (0.00 sec)

user-two@server:~$ mysql
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 39950
Server version: 5.5.38-0ubuntu0.12.04.1-log (Ubuntu)...

mysql> SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| test               |
+--------------------+
2 rows in set (0.00 sec)

When looking as root for this users in case they are registered

mysql> use mysql
mysql> SELECT * FROM user WHERE User = 'user-one';
Empty set (0.00 sec)

mysql> SELECT * FROM user WHERE User = 'user-two';
Empty set (0.00 sec)

1 Answer 1

2

By default ''@localhost, and other bunch of accounts exist in a freshly installed MySQL instance.

If you execute SELECT user() you may see something like this:

mysql> SELECT user();
+--------------------+
| user()             |
+--------------------+
| user-one@localhost |
+--------------------+
1 row in set (0.00 sec)

That user doesn't really exist, and it is actually mapped for authentication and authorization to:

mysql> SELECT current_user();
+----------------+
| current_user() |
+----------------+
| ''@localhost   |
+----------------+
1 row in set (0.00 sec)

In order to fix this, run the script mysql_secure_installation always after setting up a production database, and it will ask you to set a mysql root password, delete remote access and delete the passwordless default accounts. This should be part of any proper mysql installation process, and it is documented here.

Starting with 5.6 and 5.7, better security defaults are used, but only on official packages.

Remember that by default, all users have write permissions to write on test% databases. That is a very dangerous default, and should be fixed before production.

5
  • if I run this script in production environment, will this affect in something?
    – tachomi
    Oct 20, 2014 at 16:16
  • @tachomi it affects the grant privilege tables. Test it beforehand so none of your applications is using one of the anonymous users. Alternatively, you can manually delete ''@localhost user and other grants, but it is not trivial.
    – jynus
    Oct 20, 2014 at 16:19
  • If I'm pretty sure my apps aren't using any of this users, can I make it?
    – tachomi
    Oct 20, 2014 at 16:23
  • @tachomi Sure, it only edits the mysql.* tables.
    – jynus
    Oct 20, 2014 at 16:32
  • Awesome buddy, thanks a lot for the advice and the complete information.
    – tachomi
    Oct 20, 2014 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.