0

I'm curious and learning...this is non-urgent

On a production server running 19 databases I entered this typo

mysql -uroot-p[passwd]
            ^ omitted space

I soon enjoyed a solid 12 seconds of Shark-Eats-Quint-Grade elevated heart rate:

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| test               |
+--------------------+

I've confirmed this typo as harmless** but now am curious how this yielded output rather than error.

My SQL-Fu grows but is not yet very strong. I clearly attempted authentication with the unintentional user root-ppasswd, but with neither password passed to mysql nor existing true credentials I'd have expected the command to fail--did this spawn a new theoretical DB instance awaiting its chance to be permanently written?

** Please allow me to preempt those inclined to stress the danger of premature engagement with the <enter> key. Yes--hollowpoint ducked.

2 Answers 2

5

It's treating the whole string as the username and without a password the MySQL client is logging you in as anon.

mysql -usomerandomstring
mysql> SELECT CURRENT_USER();
+----------------+
| CURRENT_USER() |
+----------------+
| @localhost     |
+----------------+
2
  • Okay, so I was correct about submitting a fabricated userID. My initial guess was close but didn't lead me far enough around the corner. Does this mean I'm logged in as a user who's simply not authorized to view anything good?
    – zedmelon
    Oct 30, 2014 at 23:22
  • 2
    From the manual: By default, a MySQL installation has an anonymous user, allowing anyone to log into MySQL without having to have a user account created for them. This is intended only for testing, and to make the installation go a bit smoother. You should remove them before moving into a production environment.
    – harvey
    Oct 30, 2014 at 23:39
1

update

I knew I'd risk learning something here. :-)

Didn't want to preclude upvotes on harvey's helpful answer but address fellow SQL noobs...

As harvey mentioned, I've tripped over anonymous login. My manual doesn't reference anonymous user--not that I read its entirety before posting or even knew what to seek, which is why web search quickly yielded to ServerFault.

I found this advice on removing anon login, coming soon to a non-work day near you:

DELETE FROM mysql.user WHERE User='';
2
  • 1
    In general, you should find a bunch of hardening guides before putting a new major piece of infrastructure online. Oct 31, 2014 at 23:35
  • You're of course correct, but I inherited all this infrastructure and am striving to best play the hand I'm dealt. I proceed and add pieces to the puzzle. Thanks for the tip.
    – zedmelon
    Nov 13, 2014 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .