0

I'm curious and learning...this is non-urgent

On a production server running 19 databases I entered this typo

mysql -uroot-p[passwd]
            ^ omitted space

I soon enjoyed a solid 12 seconds of Shark-Eats-Quint-Grade elevated heart rate:

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| test               |
+--------------------+

I've confirmed this typo as harmless** but now am curious how this yielded output rather than error.

My SQL-Fu grows but is not yet very strong. I clearly attempted authentication with the unintentional user root-ppasswd, but with neither password passed to mysql nor existing true credentials I'd have expected the command to fail--did this spawn a new theoretical DB instance awaiting its chance to be permanently written?

** Please allow me to preempt those inclined to stress the danger of premature engagement with the <enter> key. Yes--hollowpoint ducked.

5

It's treating the whole string as the username and without a password the MySQL client is logging you in as anon.

mysql -usomerandomstring
mysql> SELECT CURRENT_USER();
+----------------+
| CURRENT_USER() |
+----------------+
| @localhost     |
+----------------+
|improve this answer|||||
  • Okay, so I was correct about submitting a fabricated userID. My initial guess was close but didn't lead me far enough around the corner. Does this mean I'm logged in as a user who's simply not authorized to view anything good? – zedmelon Oct 30 '14 at 23:22
  • 2
    From the manual: By default, a MySQL installation has an anonymous user, allowing anyone to log into MySQL without having to have a user account created for them. This is intended only for testing, and to make the installation go a bit smoother. You should remove them before moving into a production environment. – harvey Oct 30 '14 at 23:39
1

update

I knew I'd risk learning something here. :-)

Didn't want to preclude upvotes on harvey's helpful answer but address fellow SQL noobs...

As harvey mentioned, I've tripped over anonymous login. My manual doesn't reference anonymous user--not that I read its entirety before posting or even knew what to seek, which is why web search quickly yielded to ServerFault.

I found this advice on removing anon login, coming soon to a non-work day near you:

DELETE FROM mysql.user WHERE User='';
|improve this answer|||||
  • 1
    In general, you should find a bunch of hardening guides before putting a new major piece of infrastructure online. – Deer Hunter Oct 31 '14 at 23:35
  • You're of course correct, but I inherited all this infrastructure and am striving to best play the hand I'm dealt. I proceed and add pieces to the puzzle. Thanks for the tip. – zedmelon Nov 13 '14 at 1:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.