Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've installed MySQL for the first time. I used the MySQL 5.5.11 for Windows and used the MySql Server Instance Configuration Wizard, and chose a root password.

When I tested the system compared to 2.3.8. Windows Postinstallation Procedures everything was OK except my mysql.db is empty, even though I can see the (empty) test database using mysqlshow and SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA.

Is there a problem with my installation or is it just a documentation "error"?

EDIT: I did choose to not include an anonymous login with the SICW, so perhaps documentation "error" is closer to the truth, in that it should mention it won't be listed without an anonymous login installed?

share|improve this question
1  
This is a very good question all MySQL users should know !!! –  RolandoMySQLDBA Apr 21 '11 at 12:45

1 Answer 1

Any database named test or whose name is prefixed with test would be allowed full access granted it for anonymous accounts. According to MySQL 5.0 Certification Study Guide (ISBN 0-672-32812-7), page 498 recommends the removal of anonymous accounts and the test database.

Since that writing, MySQL 5.1 has mysql.db populated with those two rows. I have not seen that documented anywhere. Just run

DELETE FROM mysql.db;
FLUSH PRIVILEGES;
DROP DATABASE test;

and all your worries will be gone !!!

Please refrain from naming any test databases test, or test_ < anything >

UPDATE

It is perfectly OK to have mysql.db clear, especially with test databases. MySQL had included test and test_% in mysql.db by default with all privileges. Anonymous logins could therefore access any test database. A simply disk attack could hurt the mysql installation. Here is an example:

USE test
CREATE TABLE rolando_tb (a int);
INSERT INTO rolando_tb VALUES (1);
INSERT INTO rolando_tb SELECT a FROM rolando_tb;
INSERT INTO rolando_tb SELECT a FROM rolando_tb;
INSERT INTO rolando_tb SELECT a FROM rolando_tb;
INSERT INTO rolando_tb SELECT a FROM rolando_tb;

Run insert 30 times and you get a 7GB table

Imagine creating several of these tables in the test database

Imagine creating a Stored Procedure in the test database

The possibilities are endless as long as test and test_% exist in mysql.db

This is not documented. It should be !!!

It is indeed a documentation error in the area of Installtion Security. +1 for catching that !!!!!

share|improve this answer
    
May be you misread my question: Test is NOT listed in mysql.db now. –  Mark Hurd Apr 21 '11 at 10:35
    
Updated my answer yesterday –  RolandoMySQLDBA Apr 22 '11 at 15:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.