Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My MySQL server has a number of strange users which I did not add. Are these all necessary?

'root'@'127.0.0.1'
'root'@'localhost'
'root'@'SERVERNAME'
'root'@'::1'
''@'SERVERNAME'
''@'LOCALHOST'

If I remove all the root's except root@localhost, could I end up locking myself out of the database? And what is the purpose of the empty user names? They seem to just have the 'GRANT USAGE'??

Is there a difference between 127.0.0.1 as host and localhost? If I only have localhost and not 127.0.0.1, does that mean mysqlclient's that use TCP/IP instead of Unix sockets will not be able to connect?

share|improve this question
add comment

3 Answers

  1. These users seem to be the default users that were added when MySQL was installed. It is recommended that you run mysql_secure_installation after installing MySQL.

  2. The empty usernames (''@'SERVERNAME') represent anonymous users. If you didn't run mysql_secure_installation or set the password, then anyone can gain access. If the anonymous user has GRANT USAGE privileges, then it basically means it has no privileges, but it's still a good idea to remove the anonymous login completely.

  3. No, there's no big difference between localhost and 127.0.0.1. Whatever IP address the user is trying to login from must match the @[IP Address] part of the username. If your logging in from the same machine the MySQL server is on, then @localhost and @127.0.0.1 would match. As IVlint67 pointed out, in some installations having @localhost would not work so its better to go with @127.0.0.1.

share|improve this answer
add comment

I usually install with the mysql_secure_installation script MySQL is shipping with now...


root@127.0.0.1 is the @ IP address. root@localhost is @ hostname. Ditto for the server name. And the last root is @ IPv6 address for localhost.


From the MySQL site:

An attempt to connect to the host 127.0.0.1 normally resolves to the localhost account. However, this fails if the server is run with the --skip-name-resolve option, so the 127.0.0.1 account is useful in that case.

The empty usernames:

Some accounts are for anonymous users. These have an empty user name. The anonymous accounts have no password, so anyone can use them to connect to the MySQL server

http://dev.mysql.com/doc/refman/5.0/en/default-privileges.html


And finally:

If I remove all the root's except root@localhost, could I end up locking myself out of the database?

Yes, but you can get back in

See --skip-grant-tables : https://help.ubuntu.com/community/MysqlPasswordReset

Should I?

I don't care, it's your server. If it was mine, I would secure the root accounts as is with passwords and delete the anonymous accounts unless you need them.

share|improve this answer
add comment

None of them is necessary, especially the root users. You need a simple mysql root user for the connection which you use. All other can (in fact, needs to) be deleted.

Debian have a special root user for maintenance tasks, it is better if it can live further.

Simply I can't understand, why is a such braindamaged default install so needed.

share|improve this answer
    
On Debian/Ubuntu, if you can connect with sudo mysql --defaults-file=/etc/mysql/debian.cnf and a "show grants;" gives you all privileges, you have a root equivalent and no root user is needed. –  Kl4m Feb 26 at 16:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.