Mariadb – worry that root user can login into MariaDB 10.5 without password

mariadbpasswordrootSecurity

I remember when installing MySQL Server 8.0, or in some database setups, there are warnings about no password login. Should I worry about this? I think if someone gets access to root user on my debian they can reset root password of MariaDB. What is the real answer here? I appreciate doc reference.

Best Answer

Only if you have only localhost access.

When the attacker has somehow direct baccess to your server, it isn't that much important, but will still remain a nuisance for the hacker.

When you let access from outside the computer, it is vital that there is a strong password, which lets casual users not gain full access to the hole database.

Overall, yes make a passowrd

Related Solutions

Mysql – Securing Your MySQL Server within your team

Some best practices:

Create a DBA user for yourself. This should be the only user with "WITH GRANT OPTION" in their permissions. This should also be the only user with select privileges on *.* because that includes mysql.user.
Every user should have their own username and password, no shared accounts. They should each have permissions to specific databases; again, not *.*.
And then delete that shared root user.
Don't let non-DBAs have root access on your db server.
Symlink your ~/.mysql_history file to /dev/null and it won't record anything.

There are others; this will get you to a better place.

You can also write a little script that outputs the grants (e.g., using pt-show-grants) and diffs to the previous output, and then emails you when there's a difference.

btw, it's hard to have enough space to store a general log on an active production system. It can get very big very quickly.

MariaDB Access – How to Make Root Access via Client App

The answer to this question should help you out:

$ sudo mysql -u root

[mysql] use mysql;
[mysql] update user set plugin='' where User='root';
[mysql] flush privileges;

In short, the new version of MariaDB checks to see what the system user is and only allows the actual system user root to log in to the DB user root. Disabling all plugins disables that functionality.

Best Answer

Related Solutions

Mysql – Securing Your MySQL Server within your team

MariaDB Access – How to Make Root Access via Client App

Related Question