Google Git
Sign in
webkit / WebKit / 79e0437d70e733359c28b85bcc2ccbfd11509a03 / . / BugsSite / docs / html / security-mysql.html
blob: 43ad40f75953de2139395a5912103440a48385a4 [file] [log] [blame]
timothy@apple.comf42518d2008-02-06 20:19:16 +0000[diff] [blame]1<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
2<HTML
3><HEAD
4><TITLE
5>MySQL</TITLE
6><META
7NAME="GENERATOR"
8CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
9REL="HOME"
10TITLE="The Bugzilla Guide - 2.20.1
11 Release"
12HREF="index.html"><LINK
13REL="UP"
14TITLE="Bugzilla Security"
15HREF="security.html"><LINK
16REL="PREVIOUS"
17TITLE="Operating System"
18HREF="security-os.html"><LINK
19REL="NEXT"
20TITLE="Webserver"
21HREF="security-webserver.html"></HEAD
22><BODY
23CLASS="section"
24BGCOLOR="#FFFFFF"
25TEXT="#000000"
26LINK="#0000FF"
27VLINK="#840084"
28ALINK="#0000FF"
29><DIV
30CLASS="NAVHEADER"
31><TABLE
32SUMMARY="Header navigation table"
33WIDTH="100%"
34BORDER="0"
35CELLPADDING="0"
36CELLSPACING="0"
37><TR
38><TH
39COLSPAN="3"
40ALIGN="center"
41>The Bugzilla Guide - 2.20.1
42 Release</TH
43></TR
44><TR
45><TD
46WIDTH="10%"
47ALIGN="left"
48VALIGN="bottom"
49><A
50HREF="security-os.html"
51ACCESSKEY="P"
52>Prev</A
53></TD
54><TD
55WIDTH="80%"
56ALIGN="center"
57VALIGN="bottom"
58>Chapter 4. Bugzilla Security</TD
59><TD
60WIDTH="10%"
61ALIGN="right"
62VALIGN="bottom"
63><A
64HREF="security-webserver.html"
65ACCESSKEY="N"
66>Next</A
67></TD
68></TR
69></TABLE
70><HR
71ALIGN="LEFT"
72WIDTH="100%"></DIV
73><DIV
74CLASS="section"
75><H1
76CLASS="section"
77><A
78NAME="security-mysql"
79>4.2. MySQL</A
80></H1
81><DIV
82CLASS="section"
83><H2
84CLASS="section"
85><A
86NAME="security-mysql-account"
87>4.2.1. The MySQL System Account</A
88></H2
89><P
90>As mentioned in <A
91HREF="security-os.html#security-os-accounts"
92>Section 4.1.2</A
93>, the MySQL
94 daemon should run as a non-privleged, unique user. Be sure to consult
95 the MySQL documentation or the documentation that came with your system
96 for instructions.
97 </P
98></DIV
99><DIV
100CLASS="section"
101><H2
102CLASS="section"
103><A
104NAME="security-mysql-root"
105>4.2.2. The MySQL <SPAN
106CLASS="QUOTE"
107>"root"</SPAN
108> and <SPAN
109CLASS="QUOTE"
110>"anonymous"</SPAN
111> Users</A
112></H2
113><P
114>By default, MySQL comes with a <SPAN
115CLASS="QUOTE"
116>"root"</SPAN
117> user with a
118 blank password and an <SPAN
119CLASS="QUOTE"
120>"anonymous"</SPAN
121> user, also with a blank
122 password. In order to protect your data, the <SPAN
123CLASS="QUOTE"
124>"root"</SPAN
125> user
126 should be given a password and the anonymous user should be disabled.
127 </P
128><DIV
129CLASS="example"
130><A
131NAME="security-mysql-account-root"
132></A
133><P
134><B
135>Example 4-1. Assigning the MySQL <SPAN
136CLASS="QUOTE"
137>"root"</SPAN
138> User a Password</B
139></P
140><TABLE
141BORDER="0"
142BGCOLOR="#E0E0E0"
143WIDTH="100%"
144><TR
145><TD
146><FONT
147COLOR="#000000"
148><PRE
149CLASS="screen"
150>&#13;<SAMP
151CLASS="prompt"
152>bash$</SAMP
153> mysql mysql
154<SAMP
155CLASS="prompt"
156>mysql&#62;</SAMP
157> UPDATE user SET password = password('<VAR
158CLASS="replaceable"
159>new_password</VAR
160>') WHERE user = 'root';
161<SAMP
162CLASS="prompt"
163>mysql&#62;</SAMP
164> FLUSH PRIVILEGES;
165 </PRE
166></FONT
167></TD
168></TR
169></TABLE
170></DIV
171><DIV
172CLASS="example"
173><A
174NAME="security-mysql-account-anonymous"
175></A
176><P
177><B
178>Example 4-2. Disabling the MySQL <SPAN
179CLASS="QUOTE"
180>"anonymous"</SPAN
181> User</B
182></P
183><TABLE
184BORDER="0"
185BGCOLOR="#E0E0E0"
186WIDTH="100%"
187><TR
188><TD
189><FONT
190COLOR="#000000"
191><PRE
192CLASS="screen"
193>&#13;<SAMP
194CLASS="prompt"
195>bash$</SAMP
196> mysql -u root -p mysql <A
197NAME="security-mysql-account-anonymous-mysql"
198><IMG
199SRC="../images/callouts/1.gif"
200HSPACE="0"
201VSPACE="0"
202BORDER="0"
203ALT="(1)"></A
204>
205<SAMP
206CLASS="prompt"
207>Enter Password:</SAMP
208> <VAR
209CLASS="replaceable"
210>new_password</VAR
211>
212<SAMP
213CLASS="prompt"
214>mysql&#62;</SAMP
215> DELETE FROM user WHERE user = '';
216<SAMP
217CLASS="prompt"
218>mysql&#62;</SAMP
219> FLUSH PRIVILEGES;
220 </PRE
221></FONT
222></TD
223></TR
224></TABLE
225><DIV
226CLASS="calloutlist"
227><DL
228COMPACT="COMPACT"
229><DT
230><A
231HREF="security-mysql.html#security-mysql-account-anonymous-mysql"
232><IMG
233SRC="../images/callouts/1.gif"
234HSPACE="0"
235VSPACE="0"
236BORDER="0"
237ALT="(1)"></A
238></DT
239><DD
240>This command assumes that you have already completed
241 <A
242HREF="security-mysql.html#security-mysql-account-root"
243>Example 4-1</A
244>.
245 </DD
246></DL
247></DIV
248></DIV
249></DIV
250><DIV
251CLASS="section"
252><H2
253CLASS="section"
254><A
255NAME="security-mysql-network"
256>4.2.3. Network Access</A
257></H2
258><P
259>If MySQL and your webserver both run on the same machine and you
260 have no other reason to access MySQL remotely, then you should disable
261 the network access. This, along with the suggestion in
262 <A
263HREF="security-os.html#security-os-ports"
264>Section 4.1.1</A
265>, will help protect your system from
266 any remote vulnerabilites in MySQL.
267 </P
268><DIV
269CLASS="example"
270><A
271NAME="security-mysql-network-ex"
272></A
273><P
274><B
275>Example 4-3. Disabling Networking in MySQL</B
276></P
277><P
278>Simply enter the following in <TT
279CLASS="filename"
280>/etc/my.conf</TT
281>:
282 <TABLE
283BORDER="0"
284BGCOLOR="#E0E0E0"
285WIDTH="100%"
286><TR
287><TD
288><FONT
289COLOR="#000000"
290><PRE
291CLASS="screen"
292>&#13;[myslqd]
293# Prevent network access to MySQL.
294skip-networking
295 </PRE
296></FONT
297></TD
298></TR
299></TABLE
300>
301 </P
302></DIV
303></DIV
304></DIV
305><DIV
306CLASS="NAVFOOTER"
307><HR
308ALIGN="LEFT"
309WIDTH="100%"><TABLE
310SUMMARY="Footer navigation table"
311WIDTH="100%"
312BORDER="0"
313CELLPADDING="0"
314CELLSPACING="0"
315><TR
316><TD
317WIDTH="33%"
318ALIGN="left"
319VALIGN="top"
320><A
321HREF="security-os.html"
322ACCESSKEY="P"
323>Prev</A
324></TD
325><TD
326WIDTH="34%"
327ALIGN="center"
328VALIGN="top"
329><A
330HREF="index.html"
331ACCESSKEY="H"
332>Home</A
333></TD
334><TD
335WIDTH="33%"
336ALIGN="right"
337VALIGN="top"
338><A
339HREF="security-webserver.html"
340ACCESSKEY="N"
341>Next</A
342></TD
343></TR
344><TR
345><TD
346WIDTH="33%"
347ALIGN="left"
348VALIGN="top"
349>Operating System</TD
350><TD
351WIDTH="34%"
352ALIGN="center"
353VALIGN="top"
354><A
355HREF="security.html"
356ACCESSKEY="U"
357>Up</A
358></TD
359><TD
360WIDTH="33%"
361ALIGN="right"
362VALIGN="top"
363>Webserver</TD
364></TR
365></TABLE
366></DIV
367></BODY
368></HTML
369>