2

With a fresh (but old) install of Ubuntu and MySQL, I found I could access the MySQL via command line client without being asked for any user or password.

This bothered me as the default situation, and I tried to investigate it. Logging in as root required the root password. But logging in without specifying the user (ie, just typing mysql on the command line) asked me for neither user nor password.

I think I've tracked it down to the user debian-sys-maint, which appears to have full MySQL permissions on the one hand, and is also the default client user as defined in /etc/mysql/debian.cnf on the other.

My first instinct was to get rid of the user entirely, because this seemed a security hole to me, but upon reading up, including the posts linked below, it seems that debian-sys-maint is needed.

So my plan is to try the following:

REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'debian-sys-maint';
GRANT RELOAD on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'xxxxxx';
FLUSH PRIVILEGES;

Can anyone comment on this as the recommended / expected / correct way to secure a default MySQL installation?

Should I also alter /etc/mysql/debian.cnf to remove this section?

[client]
host     = localhost
user     = debian-sys-maint
password = xxxxxx
socket   = /var/run/mysqld/mysqld.sock

(It does warn: # Automatically generated for Debian scripts. DO NOT TOUCH!)

I intend to replace it with my own ~/.my.cnf client section anyway.


Update: The permissions on /etc/mysql/debian.cnf are:

-rw------- 1 root root 312 2012-05-20 23:07 /etc/mysql/debian.cnf

References:

10
  • 2
    The simple fact is, that if a person has root-access on host system, then the user has root access to the Mysql server. It is trivial bypass mysql authentication. It just takes restarting the mysql server with the correct command line options. So stop, and think about what threats you are trying to protect against here. Are you worried about the system root user, doing things the system root user has privileges to do already? Are you worried about the permissions being set wrong on the debian.cnf file? Or what.
    – Zoredache
    Aug 11, 2014 at 23:26
  • 1
    Did you log in into mysql via root-account or from a regular unprivileged useraccount? The latter would be a huge security risk and can by no means be the default behaviour. However, the debian-sys-maint user is used in mysql to roll the logs and therefore should not be deleted. Don't remove that section in the cnf file as this will prevent the user from logging into mysql. Revoking the priviliges is an option, however consider that if you do that you will have no fallback if you ever lose the mysql-root-password (shouldn't happen, just saying).
    – Broco
    Aug 11, 2014 at 23:37
  • @Zoredache - It's a good question, what am I protecting against. I guess it was my initial shock - I had just installed MySQL, set a root password during the install, and suddenly I could login without a password, and had no idea how or who, and immediately felt "That's not right."
    – Stewart
    Aug 12, 2014 at 4:20
  • @Broco - On Ubuntu, pretty much everything is done from a regular account, and with root actions being done using sudo. I logged into MySQL from a regular account, without being asked user / password. I believe that it was the debian-sys-maint user that I was going in as.
    – Stewart
    Aug 12, 2014 at 4:22
  • Ok, so your questions got me thinking. I checked select user() and found it may not be anything to do with debian-sys-maint at all. Apparently I'm logging in as stewart@localhost - but there is no user stewart in the table user. I do not understand this at all.
    – Stewart
    Aug 12, 2014 at 4:33

1 Answer 1

2

The answer to this is that the debian-sys-maint account is a red-herring.

The phenomena I was looking at was a MySQL "anonymous" user.

This is answered by these 2 questions, as well as my own that I posted yesterday:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .