Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our MySQL log displayed a warning on restart about 2 root users not having passwords.

I went into MySQL and checked all users:

mysql> select * from mysql.user;

and see:

Host       |    User   |   Password
localhost       root      *76685yt868itetc
web12-b0        root
127.0.0.1       root  

First off, why are there 3 root users (and do we need 127.0.0.1 since we have localhost)?

Second, why would two of them not have passwords set?

Third, do the web12-b0 and 127.0.0.1 hosts have full root access without having to use a password (as it appears)?

Fourth, is there some valid reason for this or should I suggest the admin put passwords on those two hosts?

Thanks for your answers.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

I know this is an old thread, but I wanted to add a few more points:

Three root users are generated by default when you first create a database. The are all created without passwords. At that time, the installation also recommends you set a password by running mysqladmin -u root password, which will change the password for 'root'@'%'.

The two that still don't have passwords are local to the host specified in the Host column; in both of these cases, it's the actual DB server. They do both have full access to the database by default. One might correctly surmise that, in many cases, if you were able to log in to the machine (which would be necessary to use either of these root accounts) in the first place, then you probably have access to the actual files on disk. So having passwords on these might not yield any real security.

That being said, I prefer to remove these default accounts, and stick with password-ed accounts.

DELETE FROM mysql.user WHERE Password=''; FLUSH PRIVILEGES

share|improve this answer
2  
Good addition, Aaron. One thing, though... I believe that the following command helps take care of this (though I am not certain): /usr/bin/mysql_secure_installation –  Lothar_Grimpsenbacher Mar 5 at 18:46
    
Nice! I hadn't heard of that one. Looks like it does do most of this by default, though it disables all root users except local ones: dev.mysql.com/doc/refman/5.6/en/mysql-secure-installation.html –  Aaron R. Mar 6 at 20:27
add comment

First off, why are there 3 root users

Because someone added three root users.

(and do we need 127.0.0.1 since we have localhost)?

In MySQL localhost and 127.0.0.1 are fundamentally different. The host 'localhost' in MySQL means "connect locally using a unix socket". The 127.0.0.1 host means "connect via the loopback interface using TCP".

Second, why would two of them not have passwords set?

Because noone set a password for them.

Third, do the web12-b0 and 127.0.0.1 hosts have full root access without having to use a password (as it appears)?

You have provided insufficient information to answer this. The presence of a user in MySQL implies no permission besides USAGE (the ability to connect). To view the permissions for a user you must use:

SHOW GRANTS FOR user@host;

Fourth, is there some valid reason for this or should I suggest the admin put passwords on those two hosts?

I would advise against having any accounts without a password on your MySQL server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.