Are these MySQL user settings vulnerable?

Question

I'm using PHPMyAdmin to manage the databases and I'm new to SQL in general. Am I suppose to keep an open anonymous user on localhost so things like Drupal can access MySQL? It seems like having a non-passworded root on my server's hostname is retarded but I don't know what I'm doing with this in general. The user who's name starts with a b is the one I use to login and do things like make a database.

Answer 1

you do not need accounts that are not password protected. my suggestions:

• leave root account with access from localhost, having all proivileges with password protection
• remove other root accounts
• create limited account [ probably just select/insert/update/delete ] for your webapps.
• when you are doing some webapp updates [ that require change in sql structure ] temporarily grant user from previous point rights to modify the structure and after successful upgrade - revoke those.

Answer 2

Any application you have that is accessing MySQL should be supplying credentials to connect, and should be using an account that only has enough rights to do what it needs. There is no need to have an account that just needs to be able to write to your Drupal database, have access to all databases on the server, for instance.

Once you have that set up you can get rid of, or add a password to, the accounts that don't have a password therefore removing that security hole.