I'm using PHPMyAdmin to manage the databases and I'm new to SQL in general. Am I suppose to keep an open anonymous user on localhost so things like Drupal can access MySQL? It seems like having a non-passworded root on my server's hostname is retarded but I don't know what I'm doing with this in general. The user who's name starts with a b is the one I use to login and do things like make a database.


you do not need accounts that are not password protected. my suggestions:

  • leave root account with access from localhost, having all proivileges with password protection
  • remove other root accounts
  • create limited account [ probably just select/insert/update/delete ] for your webapps.
  • when you are doing some webapp updates [ that require change in sql structure ] temporarily grant user from previous point rights to modify the structure and after successful upgrade - revoke those.
  • Thanks, I now just have root@localhost and b[username]@localhost with only SELECT, INSERT, UPDATE, DELETE, FILE privileges. – defectivehalt Mar 22 '10 at 14:47
  • @Kavon Farvardin - sooner or later you'll need to grant 'alter table / create table' etc to b - when upgrade comes. just for that time. and then revoke. – pQd Mar 22 '10 at 19:31

Any application you have that is accessing MySQL should be supplying credentials to connect, and should be using an account that only has enough rights to do what it needs. There is no need to have an account that just needs to be able to write to your Drupal database, have access to all databases on the server, for instance.

Once you have that set up you can get rid of, or add a password to, the accounts that don't have a password therefore removing that security hole.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.