MySQL Security – Securing debian-sys-maint User

MySQLSecurityuser-accounts

With a fresh (but old) install of Ubuntu and MySQL, I found I could access the MySQL via command line client without being asked for any user or password.

This bothered me as the default situation, and I tried to investigate it. Logging in as root required the root password. But logging in without specifying the user (ie, just typing mysql on the command line) asked me for neither user nor password.

I think I've tracked it down to the user debian-sys-maint, which appears to have full MySQL permissions on the one hand, and is also the default client user as defined in /etc/mysql/debian.cnf on the other.

My first instinct was to get rid of the user entirely, because this seemed a security hole to me, but upon reading up, including the posts linked below, it seems that debian-sys-maint is needed.

So my plan is to try the following:

REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'debian-sys-maint';
GRANT RELOAD on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'xxxxxx';
FLUSH PRIVILEGES;

Can anyone comment on this as the recommended / expected / correct way to secure a default MySQL installation?

Should I also alter /etc/mysql/debian.cnf to remove this section?

[client]
host     = localhost
user     = debian-sys-maint
password = xxxxxx
socket   = /var/run/mysqld/mysqld.sock

(It does warn: # Automatically generated for Debian scripts. DO NOT TOUCH!)

I intend to replace it with my own ~/.my.cnf client section anyway.

Update:
The permissions on /etc/mysql/debian.cnf are:

-rw------- 1 root root 312 2012-05-20 23:07 /etc/mysql/debian.cnf

References:

Best Answer

The answer to this is that the debian-sys-maint account is a red-herring.

The phenomena I was looking at was a MySQL "anonymous" user.

This is answered by these 2 questions, as well as my own that I posted yesterday:

Related Solutions

Debian MySQL User – What is the debian-sys-maint MySQL User?

What is debian-sys-maint used for?

One major thing it is used for is telling the server to roll the logs. It needs at least the reload and shutdown privilege.

See the file /etc/logrotate.d/mysql-server

It is used by the /etc/init.d/mysql script to get the status of the server. It is used to gracefully shutdown/reload the server.

Here is the quote from the README.Debian

* MYSQL WON'T START OR STOP?:
=============================
You may never ever delete the special mysql user "debian-sys-maint". This user
together with the credentials in /etc/mysql/debian.cnf are used by the init
scripts to stop the server as they would require knowledge of the mysql root
users password else.

What is the easiest way to restore it after I've lost it?

The best plan is to simply not lose it. If you really lose the password, reset it, using another account. If you have lost all admin privileges on the mysql server follow the guides to reset the root password, then repair the debian-sys-maint.

You could use a command like this to build a SQL file that you can use later to recreate the account.

mysqldump --complete-insert --extended-insert=0 -u root -p mysql | grep 'debian-sys-maint' > debian_user.sql

Is the password in /etc/mysql/debian.cnf already hashed

The password is not hashed/encrypted when installed, but new versions of mysql now have a way to encrypt the credentials (see: https://serverfault.com/a/750363).

Mysql – Enabling remote access to thesql on debian

In response to your questions.

The "Any" user and the "test" database are used by mysql during installation to check that the database was installed properly. You can safely remove both after the installation.

I am unsure about the redundancy in the root user "localhost" and "127.0.0.1". Mysql probably just does that to be safe.

To allow remote access, you will need to edit the file /etc/mysql/my.cnf to make mysql bind to external interfaces. By default, mysql will only accept connections from localhost for security reasons. Follow the instructions given here.

After that, create a new user and give it the user's ip or '%' for all ips and restart mysql. The remote user should now be able to connect to the mysql instance.

Related Topic