grants question

dominant

Hello all

I have installed mysql 4.0.21

I want to create a user that will have all the legal rights to a specific database. (not other database or the server itself).

I am using

GRANT ALL PREVILEGES on database.* to user@localhost identified by 'password'

Is there any potential threat by doing the above command?

nemonoman

only the obvious problem...but SOMEBODY needs to be granted ALL on this db. Only real danger is trustworthiness of user@localhost identified by 'password' for managing this specific db.

dominant

well, what is the obvious problem?

Dvector

If you want to limit the grants to user@localhost, then you should say which operations you want the user to have. Granting all privilages will give all privilages except GRANT OPTION (which is used to change grants). I would limit grants to only the operations required for the user to administer his/her own database/table.

Basic requirements to use a database table:
ALTER
CREATE
DROP
INDEX
INSERT
LOCK TABLES
SELECT
UPDATE

http://dev.mysql.com/doc/mysql/en/privileges-provided.html has a list of the grants available.
http://dev.mysql.com/doc/mysql/en/mysql-database-administration.html has extensive information dealing with user administration.

dominant

i gave

SHOW GRANTS FOR user@localhost

and i received

+----------------------------------------------------------------------------------------+
| Grants for user@localhost                                                              |
+----------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'user'@'localhost' IDENTIFIED BY PASSWORD '59661egd257g9f2g'     |
| GRANT ALL PRIVILEGES ON `database`.* TO 'user'@'localhost'                             |
+----------------------------------------------------------------------------------------+

Show user has USAGE grant for ., can this be possible?

Dvector

USAGE specifies that no privileges are available to user on . (global) when identified by a password, and all privileges on database.* when not identified by a password

dominant

And what do you mean by

and all privileges on database.* when not identified by a password

pontential passwordless account ?

Dvector

GRANT USAGE ON . TO 'user'@'localhost' IDENTIFIED BY PASSWORD '59661egd257g9f2g'

This gives 'user' no privileges on . (everything) when identified by that password.

GRANT ALL PRIVILEGES ON database.* TO 'user'@'localhost'

This gives 'user' all privieges on 'database' without regard to the password.