Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a wildcard %.mydomain.com? Which is more secure? Is localhost === 127.0.0.1? If not what is the difference?

Also, what is my domain from MySQL's or Wordpress' pov when I am connected by ssh terminal? How about When I connect by Webmin or Usermin? Does MySQL see me as Webmin or my Unix user?

share|improve this question
    
What does your last paragraph mean? I don't understand it. –  Alexander Janssen Oct 4 '12 at 20:34
    
@AlexanderJanssen I administer/ develop from putty or webmin. Do I look to MySQL like I am at localhost or my real ip when I am on a terminal connection? What domain do I use for my administration user? I don't want to grant more than is necessary for any user(even me) because I have read that it is advisable to limit the domains to the smallest possible set to thwart some hackers. I know I am paranoid, but I've been hacked. This is why MySQL is set up where you have to explicitly add domains and permissions, right? What is the smallest set for remote login? Sorry if that wasn't clear. –  Sinthia V Oct 4 '12 at 21:02
1  
If you connect to the host where the database server is running, and run mysql there, you look to MySQL as localhost. Note, there's a difference between connecting via IP (as in 127.0.0.1:3306) or via a socket, which is the default if you don't user --host=127.0.0.1 --port=3306. –  Alexander Janssen Oct 4 '12 at 21:21
    
Wonderful! It is truly good to understand the whys of these things. I am setting up my whole vps from the ground up for retail Wordpress hosting for power users. I am looking to host designers and developers who need managed hosting, so I need to make security job one. I am taking a "only add exactly the permissions someone needs and not a bit more" attitude. And I fully expect to be attacked and maybe even hacked. Sad but true. Locks are for honest people. But locks certainly slow them down. I want to make having their blog hacked something my users don't have to fear because I'm on it. –  Sinthia V Oct 5 '12 at 15:17

2 Answers 2

If everything is running on the same host, 'user'@'localhost' is sufficient.

Yes, localhost is the hostname for 127.0.0.1. It's the same. You should use localhost though, it makes things with MySQL easier.

Create a database with CREATE DATABASE wordpress; and chose a user with an appropriate password, like GRANT ALL PRIVILEGES ON wordpress.* TO 'user'@'localhost' IDENTIFIED BY 'sydfgkjhdsgj';.

Don't forget to run FLUSH PRIVILEGES; after setting up the user.

share|improve this answer
    
Thank you. Is it true that user only really needs 4 privileges? –  Sinthia V Oct 4 '12 at 20:46
    
I don't know, that depends on what exactly Wordpress is doing. You can refine the privileges in a lot of different ways, like only USAGE and SELECT, or only UPDATES but no INSERT... I ain't no Wordpress expert. –  Alexander Janssen Oct 4 '12 at 21:19
    
Some Wordpress plugins also need permission to create tables. Some will also try to drop their tables when you uninstall them but it's safer not to grant that permission. Check the Wordpress docs for the permissions a base install needs. Don't rely on guesswork. –  John Gardeniers Oct 4 '12 at 21:42
    
The Wordpress documentation says GRANT ALL PRIVILEGES. I'm not too convinced either though. –  Alexander Janssen Oct 4 '12 at 22:09
    
I'd definitely say I'm in need of convincing on this. I don't believe in GRANT ALL as a matter of security philosophy. –  Sinthia V Oct 5 '12 at 15:21

Unless you have an actual need to do so, never use wildcard permissions. localhost should be all you need in your case. Be aware though that depending on how the system has been configured it is possible that localhost won't be resolved. I've never understood why but some hosting companies deliberately set it up that way.

localhost should resolve to 127.0.0.1, making them the same thing for networking purposes, but as far as MySQL is concerned they are two different things when used to identify users. Choose one and stick with it for consistency.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.