HELP-Security-problem

Anon

Hi,
I've taken an account with a provider (php-mysql, ...)

Now i've discovered that when i install phpmyadmin, I can view and modify all databases installed on the server where my site is...(I mean..serious passwd's etc..!!!Hackers heaven!!!..)

If I can do that to them...then someone else can do that to me as well..

Is there a way to shield a database so that it cannot be viewed etc.. by phpmyadmin or a homemade script and still be fully functional?

Ofcourse..Individual users should be able to use something to view and admin their own DB.

Hope someone can help me on the way to a sollution,
Thanx in advance!.

mike

Anon

You can send the ISP admin a message having him to

mysqladmin -uroot password 'password'

have him
$ mysql mysql -uuserid -p

mysql> revoke all on . dbuser@localhost
for EVERY user on the system (mysql users)

then give each user permission to their database
have him/her

mysql> grant insert, select, delete,update on userdbs.* to user@localhost identified by 'password'

Point him to the mysql documents or see if you can get paid to manage his database system, since they seem to just install and go...

I'm sure he/she would be pleased... this

I wrote a application designed to manage the mysql user/permission system using php

If interested goto
http://pccs-linux.com/public/list.php3?bn=agora_pccslinux

MySQLDatabase Admin Tool

The SQL syntax was written on the fly, you may have to RTM

HTH

Anon

Hi CT,

thanx for the detailed information.
Since my wake-up call to my provider this morning, I've been called a few times by them for information, help etcetc.
Obviously they got scared sh*tless.

I also supplied them with your information, for which I at least, am very greatfull.

I'm gonna look into this material further because this has been the second time this week that I, more or less accidentally, gain acces to data which is supposed to be restricted.(once with idg.net and once with a dutch major provider)

Looks like security is the single, still undiscovered, sure-fire way to make a living on the web...

thanks again,
mike