2

With a fresh (but old) install of Ubuntu and MySQL, I found I could access the MySQL via command line client without being asked for any user or password.

Logging in as root requires the root password. But logging in without specifying the user (ie, just typing mysql on the command line) asks me for neither user nor password.

I'm logged in as stewart@localhost. No such user exists in the mysql.user table.

This user can see the information_schema database.

Why does the user exist? I thought MySQL users were separate from OS system accounts.

Improve this question
8
  • dev.mysql.com/doc/refman/5.0/en/…
    – user9517
    Aug 12, 2014 at 8:39
  • OK, so my reading of that is that it's normal. Why have I never noticed it before? I would have expected to simply not be granted access.
    – Stewart
    Aug 12, 2014 at 8:47
  • 1
    This is due to the "debian-sys-maint"-user. Your user account should be in the admin group. However, this system user should no longer exist in newer installations. Search for "mysql debian-sys-maint" for more information. It was a system account used for rolling logs and other tasks.
    – Broco
    Aug 12, 2014 at 13:39
  • The stewart user is indeed in the admin group. I though debian-sys-maint had something to do with it, hence my previous question : serverfault.com/questions/619633/…
    – Stewart
    Aug 12, 2014 at 14:05
  • 1
    @Stewart Dang, I should have figured this question was related to the other question. May I ask for Ubuntu version? I tried to log in to mySQL from Ubuntu 12.04 and 14.04 without credentials from my administrative user account, even as root it was not possible so I think they removed this "feature" which is in fact a huge security risk and I cannot think of any reason for its existence. Granting root access to MySQL without credentials COULD be ok but in fact you are right, MySQL users are and should be separate users in newer versions.
    – Broco
    Aug 12, 2014 at 15:13

1 Answer 1

Reset to default
1

MySQL treats unknown username as anonymous user, so check for any lines in user-table that have empty string in the username column. Removing these, or setting the password, will prevent logging in without password.

You can check if you are connected as anonymous user with SELECT CURRENT_USER().

Improve this answer
1

Not the answer you're looking for? Browse other questions tagged or ask your own question.