Linux – Is it ok to leave the MySQL root password blank

linuxMySQLSecurity

Does a root user without a password constitute a security breach if my MySQL server only accepts connections from localhost?

I'm aware that the common wisdom says the root user should be protected by a password, but what are the implications of leaving it blank? I'm not concerned about Linux users other than my own connecting to MySQL and I am not planning to allow network access to the database.

Edit: What makes MySQL that different from SQLite, which isn't password protected? What kind of deployment scenarios are we talking about? If an attacker gains access to the server, what prevents the attacker from simply resetting the password?

Please keep in mind that I'm not trying to advocate anything here, I just want people's educated input on the matter.

Best Answer

Yes, I'd consider it a fairly fundamental security vulnerability. Let me illustrate that by way of a story.

Long, long ago, in my younger and less knowledgeable days, I setup a server for internal testing of various bits and pieces I was testing out. It sat on my desk, unconnected to any network (this was a long time ago, before everything had to be on a network to be able to do anything). Whilst I was out of the office, someone else had need of a machine, and took my testing machine (I didn't mind; I was using the machine on the basis that it could be taken for other things if necessary). Since it was already running the OS that was needed, they just plugged it in to the network, and installed what they needed to.

The problem was, I'd setup all sorts of test accounts on that box, with easy to guess passwords (like the ever-useful test). Even that long ago, there were no shortage of miscreants who would have nothing better to do than password-guess accounts. It didn't take very long for them to find this machine, guess a password, and have their nefarious way with it.

The moral of the story? Requirements change. Even though you don't expect to do so now, there is a reasonable chance that over the life of the machine it's role will change -- the most likely outcome, I would expect, would be that other users will have access to the machine (either legitimately, or via an application-level exploit). The chances that you'll remember to set a MySQL root password when necessary are... slim, at best.

My recommendation would be to take the 10 seconds it'll take to set a MySQL root password and drop it into ~root/.my.cnf. The once-off time cost is far less than the cost of compromise times the probability of compromise.

Related Topic