0

I want to create some mysql users for different web sites but disallow interactive connections for them.

If a evil-user get the mysql login credentials of a website, creating a conexion from terminal to the server is fair simple, but uploading a PHP script to the server is a different issue. I think this restriction is not unneccesary.

In short, how can I disallow the interactive conexion for an specific user?

1

You can't. MySQL is unable to differentiate between a CLI session and a connection from a library, or at least has no permission model to act upon that difference.

Generally, you have to make the permissions as specific as possible. A connection that should be allowed from a specific webserver should be restricted to that server alone. This reduces the attack surface considerable.

Also, if possible don't install the mysql CLI program on that server to further restrict the attack surface.

1

You generally deal with that in 1 of two ways or both if you want. You set the grant location to only allow the user connect from an ip, ip range, or hostname from where you want the user to connect to

So for example

 GRANT SELECT, INSERT ON mydb.* TO 'someuser'@'127.0.0.0.1';

To grant select and insert from localhost only. Or say your web servers are on a seperate vlan

 GRANT SELECT, INSERT ON mydb.* TO 'someuser'@'10.128.10.%';

That will allow select and insert from 10.128.10.0/24

You can also firewall off the mysql port to only allow mysql connections from hosts you want connections to come from.

  • That's right. Retricting access to localhost avoid the problem. But even so, is there a way to "disallow" interactive connections? – Peregring-lk Oct 8 '14 at 12:25
  • 1
    no there is not – Mike Oct 8 '14 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.