Huge Security Problem on MySQL on Apache

Anon

(sorry if I posted on the wrong forum earlier.)

This can't be correct!: I am virtually hosted (static IP) with a host that provides MySQL and PHP4. Great!, I though. Then I just managed, quite unintentionally, to discover the "root" passowrd, and I successfully logged in with it through phpMyAdmin. I have access to ALL of the databases owned by the various virtually-hosted subscribers to our host (this is nearly a hundred databases.) Not only can I see them, but I can do anything to them!!!!!----I'm logged in as "root." Of course, I didn't do anything malicious.
But what the *?!@#? Is MySQL security really this bad on virtually hosted sites or did my root host screw up? And toboot, I found the password in a file sitting on my own virtual domain.

Does this seem right? If so, is it possible to install my OWN MySQL in my virtual directory (say, in the root directory above /www/) that other people can't access like this?

Any comments would be very helpful...

--P.S.

Anon

This is a security problem with your host. There is no security problem with MySQL. As root you are susposed to be able to do anything.

I'd talk to your host and see what it's worth to them.

Anon

There is definitly a problem with the host. Could you post the host' name so others will not use them until they resolve this issue.

Anon

Hopefully the MySQL daemon is running as mysql not as root.......

ziong

Obviously, this problem is due to Mysql security settings. Not a security problem with MySQL.
First, "root" account should not be access by anybody. It means "root" account must be password protected.
Second, each virtually-hosted subscriber should have a MySql account to access their own database. Also, it should access only their database, not others.

If you are not the Mysql administrator, you should report this to him.
For more information how to config Mysql. Please visit :
<a target=_blank href="http://www.mysql.com/documentation/mysql/bychapter/manual_MySQL_Database_Administration.html#MySQL_Database_Administration">http://www.mysql.com/documentation/mysql/bychapter/manual_MySQL_Database_Administration.html#MySQL_Database_Administration</a>