I want to highlight the importance of reviewing mysql’s initial
set of accounts.
Say you have a mysql on abc.def.ghi.jkl running on port 3306
anonymous account with privileges without a password, then:
1. mysql (if issued on localhost)
2. mysql -h abc.def.ghi.jkl
3. mysql -u ” -h abc.def.ghi.jkl
4. mysql -u ” -h abc.def.ghi.jkl -P 3306
5. mysql -u user_which_does_not_exist -h abc.def.ghi.jkl
will all manage to get into mysql given the way mysql authenticates users is against your username and client host from where you are connecting.
This verification is done versus the following columns in the
mysql.user table, i.e., User,Host and Password columns.
An entry in the mysql.user table with the following values
User=”, Host=’%’ will accept ANY user connecting from ANYWHERE in
the world, thus disabling ANY security. Hence the reason for this
blog post highlighting the importance …