Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My MySQL server has a number of strange users which I did not add. Are these all necessary?


If I remove all the root's except root@localhost, could I end up locking myself out of the database? And what is the purpose of the empty user names? They seem to just have the 'GRANT USAGE'??

Is there a difference between as host and localhost? If I only have localhost and not, does that mean mysqlclient's that use TCP/IP instead of Unix sockets will not be able to connect?

share|improve this question
up vote 16 down vote accepted
  1. These users seem to be the default users that were added when MySQL was installed. It is recommended that you run mysql_secure_installation after installing MySQL.

  2. The empty usernames (''@'SERVERNAME') represent anonymous users. If you didn't run mysql_secure_installation or set the password, then anyone can gain access. If the anonymous user has GRANT USAGE privileges, then it basically means it has no privileges, but it's still a good idea to remove the anonymous login completely.

  3. No, there's no big difference between localhost and Whatever IP address the user is trying to login from must match the @[IP Address] part of the username. If your logging in from the same machine the MySQL server is on, then @localhost and @ would match. As IVlint67 pointed out, in some installations having @localhost would not work so its better to go with @

share|improve this answer

I usually install with the mysql_secure_installation script MySQL is shipping with now...

root@ is the @ IP address. root@localhost is @ hostname. Ditto for the server name. And the last root is @ IPv6 address for localhost.

From the MySQL site:

An attempt to connect to the host normally resolves to the localhost account. However, this fails if the server is run with the --skip-name-resolve option, so the account is useful in that case.

The empty usernames:

Some accounts are for anonymous users. These have an empty user name. The anonymous accounts have no password, so anyone can use them to connect to the MySQL server

And finally:

If I remove all the root's except root@localhost, could I end up locking myself out of the database?

Yes, but you can get back in

See --skip-grant-tables :

Should I?

I don't care, it's your server. If it was mine, I would secure the root accounts as is with passwords and delete the anonymous accounts unless you need them.

share|improve this answer

None of them is necessary, especially the root users. You need a simple mysql root user for the connection which you use. All other can (in fact, needs to) be deleted.

Debian have a special root user for maintenance tasks, it is better if it can live further.

Simply I can't understand, why is a such braindamaged default install so needed.

share|improve this answer
On Debian/Ubuntu, if you can connect with sudo mysql --defaults-file=/etc/mysql/debian.cnf and a "show grants;" gives you all privileges, you have a root equivalent and no root user is needed. – Kl4m Feb 26 '14 at 16:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.