6

Our MySQL log displayed a warning on restart about 2 root users not having passwords.

I went into MySQL and checked all users:

mysql> select * from mysql.user;

and see:

Host       |    User   |   Password
localhost       root      *76685yt868itetc
web12-b0        root
127.0.0.1       root  

First off, why are there 3 root users (and do we need 127.0.0.1 since we have localhost)?

Second, why would two of them not have passwords set?

Third, do the web12-b0 and 127.0.0.1 hosts have full root access without having to use a password (as it appears)?

Fourth, is there some valid reason for this or should I suggest the admin put passwords on those two hosts?

Thanks for your answers.

2 Answers 2

12

I know this is an old thread, but I wanted to add a few more points:

Three root users are generated by default when you first create a database. The are all created without passwords. At that time, the installation also recommends you set a password by running mysqladmin -u root password, which will change the password for 'root'@'%'.

The two that still don't have passwords are local to the host specified in the Host column; in both of these cases, it's the actual DB server. They do both have full access to the database by default. One might correctly surmise that, in many cases, if you were able to log in to the machine (which would be necessary to use either of these root accounts) in the first place, then you probably have access to the actual files on disk. So having passwords on these might not yield any real security.

That being said, I prefer to remove these default accounts, and stick with password-ed accounts.

DELETE FROM mysql.user WHERE Password=''; FLUSH PRIVILEGES

2
3

First off, why are there 3 root users

Because someone added three root users.

(and do we need 127.0.0.1 since we have localhost)?

In MySQL localhost and 127.0.0.1 are fundamentally different. The host 'localhost' in MySQL means "connect locally using a unix socket". The 127.0.0.1 host means "connect via the loopback interface using TCP".

Second, why would two of them not have passwords set?

Because noone set a password for them.

Third, do the web12-b0 and 127.0.0.1 hosts have full root access without having to use a password (as it appears)?

You have provided insufficient information to answer this. The presence of a user in MySQL implies no permission besides USAGE (the ability to connect). To view the permissions for a user you must use:

SHOW GRANTS FOR user@host;

Fourth, is there some valid reason for this or should I suggest the admin put passwords on those two hosts?

I would advise against having any accounts without a password on your MySQL server.

1
  • 5
    It would be nice to mention that default non-interactive installation on, say, Ubuntu server creates no less than 3 root accounts without password. So "someone added three root users" and "no-one set a password for them" could be summarized as "Someone installed mysql server"
    – sehe
    Nov 4, 2016 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .