MYSQL's method of removing anonymous users of improves security

2020-05-14 05:03:11
OfStack

After installing MySQL, one root user and one anonymous user will be automatically created. People pay great attention to root, but many people will ignore this anonymous user, probably because the default setting of the anonymous user is that it can only be used locally.

But if MySQL is to be served as a database to the Web server, the cost of ignoring this anonymous user can be considerable. Because by default, this anonymous user has almost the same privileges on localhost as root1. Most likely, because the visitor uploadPHP file, create a new user with this PHP file, give him a higher permission, and then use this new user to connect to MySQL of the server and manage MySQL of the server.

Delete command:



　　MySQL>UPDATE user set password=PASSWORD('your password') where user=''; 

　　MySQL>FLUSH PRIVILEGES;

Detailed steps for removing anonymous users in mysql are as follows:

mysql-u root-p ← login with root by password
Enter password: enter the password here

Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 7 to server version: 4.1.20

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql > select user, host from mysql. user; ← view user information
+------+----------------------------+
|, user, |, host, |
+------+----------------------------+
| | localhost |
| root | localhost |
| | sample. centospub. com |
centospub.com
+------+----------------------------+
4 rows in set (0.02 sec)

mysql > delete from mysql.user where user= "; ← delete anonymous user
Query OK, 2 rows affected (0.17 sec)

mysql > exit ← exit MySQL server
Bye