Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, or with a wildcard Which is more secure? Is localhost === If not what is the difference?

Also, what is my domain from MySQL's or Wordpress' pov when I am connected by ssh terminal? How about When I connect by Webmin or Usermin? Does MySQL see me as Webmin or my Unix user?

share|improve this question

closed as off-topic by HopelessN00b Apr 3 '15 at 13:42

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

What does your last paragraph mean? I don't understand it. – Alexander Janssen Oct 4 '12 at 20:34
@AlexanderJanssen I administer/ develop from putty or webmin. Do I look to MySQL like I am at localhost or my real ip when I am on a terminal connection? What domain do I use for my administration user? I don't want to grant more than is necessary for any user(even me) because I have read that it is advisable to limit the domains to the smallest possible set to thwart some hackers. I know I am paranoid, but I've been hacked. This is why MySQL is set up where you have to explicitly add domains and permissions, right? What is the smallest set for remote login? Sorry if that wasn't clear. – Sinthia V Oct 4 '12 at 21:02
If you connect to the host where the database server is running, and run mysql there, you look to MySQL as localhost. Note, there's a difference between connecting via IP (as in or via a socket, which is the default if you don't user --host= --port=3306. – Alexander Janssen Oct 4 '12 at 21:21
Wonderful! It is truly good to understand the whys of these things. I am setting up my whole vps from the ground up for retail Wordpress hosting for power users. I am looking to host designers and developers who need managed hosting, so I need to make security job one. I am taking a "only add exactly the permissions someone needs and not a bit more" attitude. And I fully expect to be attacked and maybe even hacked. Sad but true. Locks are for honest people. But locks certainly slow them down. I want to make having their blog hacked something my users don't have to fear because I'm on it. – Sinthia V Oct 5 '12 at 15:17

If everything is running on the same host, 'user'@'localhost' is sufficient.

Yes, localhost is the hostname for It's the same. You should use localhost though, it makes things with MySQL easier.

Create a database with CREATE DATABASE wordpress; and chose a user with an appropriate password, like GRANT ALL PRIVILEGES ON wordpress.* TO 'user'@'localhost' IDENTIFIED BY 'sydfgkjhdsgj';.

Don't forget to run FLUSH PRIVILEGES; after setting up the user.

share|improve this answer
Thank you. Is it true that user only really needs 4 privileges? – Sinthia V Oct 4 '12 at 20:46
I don't know, that depends on what exactly Wordpress is doing. You can refine the privileges in a lot of different ways, like only USAGE and SELECT, or only UPDATES but no INSERT... I ain't no Wordpress expert. – Alexander Janssen Oct 4 '12 at 21:19
Some Wordpress plugins also need permission to create tables. Some will also try to drop their tables when you uninstall them but it's safer not to grant that permission. Check the Wordpress docs for the permissions a base install needs. Don't rely on guesswork. – John Gardeniers Oct 4 '12 at 21:42
The Wordpress documentation says GRANT ALL PRIVILEGES. I'm not too convinced either though. – Alexander Janssen Oct 4 '12 at 22:09
I'd definitely say I'm in need of convincing on this. I don't believe in GRANT ALL as a matter of security philosophy. – Sinthia V Oct 5 '12 at 15:21

Unless you have an actual need to do so, never use wildcard permissions. localhost should be all you need in your case. Be aware though that depending on how the system has been configured it is possible that localhost won't be resolved. I've never understood why but some hosting companies deliberately set it up that way.

localhost should resolve to, making them the same thing for networking purposes, but as far as MySQL is concerned they are two different things when used to identify users. Choose one and stick with it for consistency.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.