Fresh Install of MySQL - Setting Priviledges

ThaSpY

I've never installed MySQL before, and I used wamp5 do to so. When I started up phpMyAdmin, it gave me this warning:

Your configuration file contains settings (root with no password) that correspond to the default MySQL privileged account. Your MySQL server is running with this default, is open to intrusion, and you really should fix this security hole.

So I went to the Priviledges page, and saw a table similar to this one:

User Host      Password Global privileges Grant
Any  build     No       USAGE             No
Any  localhost No       USAGE             No
root build     No       ALL PRIVILEGES    Yes
root localhost No       ALL PRIVILEGES    Yes

I'm not new to using MySQL, but I am new to setting it up. Basically, I don't understand the difference between "build" and "localhost", as well as the functions of other feilds. Yes, I tried the manual, but couldn't make any sence out of it, so hoping someone here can shed some light.

Thanks,

bastien

MySQL ships with 4 default accounts

Root from localhost
Root from anywhere
anyone (often shown as %) from localhost
anyone from anywhere

all of these accounts have no password...

Personally I remove the anyone accounts immediately, and the root account form anywhere. Then I change the password for the root account from localhost.

Then you can add new users as needed for your applications.

Read the grant privielges section in the mysql manual for more details

ramsore

In server
Build mean % anyserver
For example you can grant access to a root user if coming from a 10.9.1.1
so you need to create a root account where user is root and server is 10.9.1.1

root@10.9.1.1
root@localhost
root@anotherhost

In user
Any mean any user is a null user if you try to use any user name you can get in an work. Delete this account to avoid security holes.

Don´t forget root password or you cannot get in.

To work with phpmyadmin you need root@localhost or another user.

A user can grant access to a Database, Tables

ThaSpY

Great thanks. So I guess build is kind of like %... either way I'll just delete it and keep the root@localhost.

But I have another problem now. I created a password for root@localhost, and immediately after submitting, it locked me out of phpMyAdmin with the error:

phpMyAdmin tried to connect to the MySQL server, and the server rejected the connection. You should check the host, username and password in config.inc.php and make sure that they correspond to the information given by the administrator of the MySQL server.

MySQL said:
#1045 - Access denied for user: 'root@localhost' (Using password: NO)

Shouldn't it ask me to enter a password somewhere? I'm confused.

tomhath

On your web server where you installed phpmyadmin, there's a file called config.inc.php. Open it with your favorite text editor (Like Notepad), look for these settings and change them to this:

$cfg['Servers'][$i]['auth_type'] = 'http'; // Authentication method (config, http or cookie based)?

$cfg['Servers'][$i]['user'] = ''; // MySQL user

$cfg['Servers'][$i]['password'] = ''; // MySQL password (only needed

ramsore

As tomhath write

On your web server where you installed phpmyadmin, there's a file called config.inc.php. Open it with your favorite text editor (Like Notepad), look for these settings and change them to this:

$cfg['Servers'][$i]['auth_type'] = 'http'; // Authentication method (config, http or cookie based)?

//change http to cookie

//find this var and put your own blowfish password
$cfg['blowfish_secret'] = 'myblowfishsecret';

$cfg['Servers'][$i]['user'] = ''; // MySQL user

$cfg['Servers'][$i]['password'] = ''; // MySQL password (only needed

change auth_type to cookie and set your blowfish_secret this will able to ask you every time your mysql user and password

ThaSpY

Thanks could you explain to me exactly what a 'blowfish_secret' is and what it does?

ramsore

The follow information was taked from http://www.schneier.com/blowfish.html if you need more information just visit that page or in google type blowfish encription.

Blowfish is a symmetric block cipher that can be used as a drop-in replacement for DES or IDEA. It takes a variable-length key, from 32 bits to 448 bits, making it ideal for both domestic and exportable use. Blowfish was designed in 1993 by Bruce Schneier as a fast, free alternative to existing encryption algorithms. Since then it has been analyzed considerably, and it is slowly gaining acceptance as a strong encryption algorithm. Blowfish is unpatented and license-free, and is available free for all uses.

from here it's my own contribution:

Why you need to use blowfish encription?. In phpmyadmin you use it because the information that travel by internet is not encripted so many people can intercept your packets and can discover the password and user name that you use to access it, and therefore they can hack your system.

phpmyadmin use it only in the access page.

tomhath

Good advice ramsore! 🆒