Introduction: So I tried to use this php page to create a new user, and grant him a higher authority, the results were successful, so I can use this new user through my native MySQL client to connect to this site's MySQL server, and use this the newly created user's administrative privileges on this site to manage MySQL server and see that ...
MySQL security issues really learned something
Two days ago helping a friend organize his home room when a little about MySQL may be found in all of us will ignore the question: We know that in installing MySQL, it will automatically create a root user and an anonymous user, their initial password are empty, for the former, will remind you a lot of reference material on the attention should be given to set a password and ignore the latter, probably because the latter is set by default can only be used in the machine's sake bar.
However, if your MySQL is to provide to the Web server as the database service, and ignore the cost of this anonymous user may be quite heavy, because the default settings, this anonymous user on localhost and root almost have the same authority, this time, if the Your customers have upload the script files, script files can be MySQL database operations (for example, allows the operator to MySQL, php) permissions may have been altered beyond recognition of your MySQL: the
Today, I helped a friend organize his room when the home page, try to write a very simple implementation of the php file upload sql statements up, in which connection the words of the user, password I have tried to set an empty, host = localhost, the results of found out that my sql statement that can be implemented, then the implementation of select * from MySQL.user View user rights, found that the users localhost access is very high, even grant_priv there, (look at the time, you will find the two lines under the root user user name , the password is blank, but the authority has y \ n, that is, the anonymous user's local, remote access set up)
So I tried to use this php page to create a new user, and grant him a higher authority, the results were successful, so I can use this new user through my native MySQL client to connect to this site's MySQL server, and use this the newly created user's administrative privileges on this site to manage MySQL server and see that they can make such easy access to in-depth database operations, how do I dare to put a friend's home page space, sensitive data stored on the MySQL server do?
Suggestions for improvement:
1, in the MySQL installation is complete, not only to change the root user's password, but will also change the anonymous user's password, and methods similar to the way to change the root password:
QUOTE:
MySQL> UPDATE user set password = PASSWORD ( 'yournewpassword') where user ='';
MySQL> FLUSH PRIVILEGES;
2, unless absolutely necessary, delete the anonymous user, so that everyone must be provided to use the MySQL user name, even if a problem in the future, but also easy to find the source of the problem.
3, in addition to root user, other users, including anonymous users (if not delete the user) should not have grant permissions to prevent the uncontrolled spread out administrative privileges.
4, giving the user update \ delete \ alert \ create \ drop privileges, it should limit to a specific database, in particular, to avoid the common customers have a right to do MySQL database access operations, or your system settings are likely to be replaced.
5, check MySQL.user table, to eliminate unnecessary user shutdown_priv, reload_priv, process_priv and File_priv permissions that may leak more information, including non-MySQL server other information out.
6, if you do not intend to let your users to use MySQL database, in the provision of such a scripting language such as php, when, re-set or build your php, removed their support for MySQL's default.
Two days ago helping a friend organize his home room when a little about MySQL may be found in all of us will ignore the question: We know that in installing MySQL, it will automatically create a root user and an anonymous user, their initial password are empty, for the former, will remind you a lot of reference material on the attention should be given to set a password and ignore the latter, probably because the latter is set by default can only be used in the machine's sake bar.
However, if your MySQL is to provide to the Web server as the database service, and ignore the cost of this anonymous user may be quite heavy, because the default settings, this anonymous user on localhost and root almost have the same authority, this time, if the Your customers have upload the script files, script files can be MySQL database operations (for example, allows the operator to MySQL, php) permissions may have been altered beyond recognition of your MySQL: the
Today, I helped a friend organize his room when the home page, try to write a very simple implementation of the php file upload sql statements up, in which connection the words of the user, password I have tried to set an empty, host = localhost, the results of found out that my sql statement that can be implemented, then the implementation of select * from MySQL.user View user rights, found that the users localhost access is very high, even grant_priv there, (look at the time, you will find the two lines under the root user user name , the password is blank, but the authority has y \ n, that is, the anonymous user's local, remote access set up)
So I tried to use this php page to create a new user, and grant him a higher authority, the results were successful, so I can use this new user through my native MySQL client to connect to this site's MySQL server, and use this the newly created user's administrative privileges on this site to manage MySQL server and see that they can make such easy access to in-depth database operations, how do I dare to put a friend's home page space, sensitive data stored on the MySQL server do?
Suggestions for improvement:
1, in the MySQL installation is complete, not only to change the root user's password, but will also change the anonymous user's password, and methods similar to the way to change the root password:
QUOTE:
MySQL> UPDATE user set password = PASSWORD ( 'yournewpassword') where user ='';
MySQL> FLUSH PRIVILEGES;
2, unless absolutely necessary, delete the anonymous user, so that everyone must be provided to use the MySQL user name, even if a problem in the future, but also easy to find the source of the problem.
3, in addition to root user, other users, including anonymous users (if not delete the user) should not have grant permissions to prevent the uncontrolled spread out administrative privileges.
4, giving the user update \ delete \ alert \ create \ drop privileges, it should limit to a specific database, in particular, to avoid the common customers have a right to do MySQL database access operations, or your system settings are likely to be replaced.
5, check MySQL.user table, to eliminate unnecessary user shutdown_priv, reload_priv, process_priv and File_priv permissions that may leak more information, including non-MySQL server other information out.
6, if you do not intend to let your users to use MySQL database, in the provision of such a scripting language such as php, when, re-set or build your php, removed their support for MySQL's default.
