1

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a wildcard %.mydomain.com? Which is more secure? Is localhost === 127.0.0.1? If not what is the difference?

Also, what is my domain from MySQL's or Wordpress' pov when I am connected by ssh terminal? How about When I connect by Webmin or Usermin? Does MySQL see me as Webmin or my Unix user?

5
  • What does your last paragraph mean? I don't understand it. Oct 4, 2012 at 20:34
  • @AlexanderJanssen I administer/ develop from putty or webmin. Do I look to MySQL like I am at localhost or my real ip when I am on a terminal connection? What domain do I use for my administration user? I don't want to grant more than is necessary for any user(even me) because I have read that it is advisable to limit the domains to the smallest possible set to thwart some hackers. I know I am paranoid, but I've been hacked. This is why MySQL is set up where you have to explicitly add domains and permissions, right? What is the smallest set for remote login? Sorry if that wasn't clear.
    – Sinthia V
    Oct 4, 2012 at 21:02
  • 1
    If you connect to the host where the database server is running, and run mysql there, you look to MySQL as localhost. Note, there's a difference between connecting via IP (as in 127.0.0.1:3306) or via a socket, which is the default if you don't user --host=127.0.0.1 --port=3306. Oct 4, 2012 at 21:21
  • Wonderful! It is truly good to understand the whys of these things. I am setting up my whole vps from the ground up for retail Wordpress hosting for power users. I am looking to host designers and developers who need managed hosting, so I need to make security job one. I am taking a "only add exactly the permissions someone needs and not a bit more" attitude. And I fully expect to be attacked and maybe even hacked. Sad but true. Locks are for honest people. But locks certainly slow them down. I want to make having their blog hacked something my users don't have to fear because I'm on it.
    – Sinthia V
    Oct 5, 2012 at 15:17

2 Answers 2

1

If everything is running on the same host, 'user'@'localhost' is sufficient.

Yes, localhost is the hostname for 127.0.0.1. It's the same. You should use localhost though, it makes things with MySQL easier.

Create a database with CREATE DATABASE wordpress; and chose a user with an appropriate password, like GRANT ALL PRIVILEGES ON wordpress.* TO 'user'@'localhost' IDENTIFIED BY 'sydfgkjhdsgj';.

Don't forget to run FLUSH PRIVILEGES; after setting up the user.

7
  • Thank you. Is it true that user only really needs 4 privileges?
    – Sinthia V
    Oct 4, 2012 at 20:46
  • I don't know, that depends on what exactly Wordpress is doing. You can refine the privileges in a lot of different ways, like only USAGE and SELECT, or only UPDATES but no INSERT... I ain't no Wordpress expert. Oct 4, 2012 at 21:19
  • Some Wordpress plugins also need permission to create tables. Some will also try to drop their tables when you uninstall them but it's safer not to grant that permission. Check the Wordpress docs for the permissions a base install needs. Don't rely on guesswork. Oct 4, 2012 at 21:42
  • The Wordpress documentation says GRANT ALL PRIVILEGES. I'm not too convinced either though. Oct 4, 2012 at 22:09
  • I'd definitely say I'm in need of convincing on this. I don't believe in GRANT ALL as a matter of security philosophy.
    – Sinthia V
    Oct 5, 2012 at 15:21
1

Unless you have an actual need to do so, never use wildcard permissions. localhost should be all you need in your case. Be aware though that depending on how the system has been configured it is possible that localhost won't be resolved. I've never understood why but some hosting companies deliberately set it up that way.

localhost should resolve to 127.0.0.1, making them the same thing for networking purposes, but as far as MySQL is concerned they are two different things when used to identify users. Choose one and stick with it for consistency.

Not the answer you're looking for? Browse other questions tagged .