MRKAVANA (mrkavana@gmail.com) - www.facebook.com/kavanathai

Jul 18, 2011

How to secure anonymous user in mysql

There are two ways for securing the anonymous user.

1. Set a good password for anonymous user.
2. Disable it.

Setting password for anonymous user :

mysql> set password for ''@localhost=password('password');
Query OK, 0 rows affected (0.00 sec)

OR

2. Deleting the anonymous user.

Before:
mysql> select user,host,password from user;
+------+----------------+------------------+
| user | host | password |
+------+----------------+------------------+
| root | localhost | 27c30f0241a5b69f |
| root | mysql.lap.work | 27c30f0241a5b69f |
| root | 127.0.0.1 | 27c30f0241a5b69f |
| | localhost | 27c30f0241a5b69f | ->anonymous user
| | mysql.lap.work | 27c30f0241a5b69f | ->anonymous user
+------+----------------+------------------+
5 rows in set (0.00 sec)

Deleting..
mysql> delete from mysql.user where user = '';
Query OK, 2 rows affected (0.00 sec)

After:
mysql> select user,host,password from user;
+------+----------------+------------------+
| user | host | password |
+------+----------------+------------------+
| root | localhost | 27c30f0241a5b69f |
| root | mysql.lap.work | 27c30f0241a5b69f |
| root | 127.0.0.1 | 27c30f0241a5b69f |
+------+----------------+------------------+
3 rows in set (0.00 sec)
mysql>

Dont forget to flush privileges after deleting/modifying users or resetting passwords.

mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)
mysql>



mysql> set password for ''@FQDN=password('password');
Query OK, 0 rows affected (0.00 sec)
mysql>

No comments:

Post a Comment