Skip to content

Commit 0be85cb

Browse files
committed
user host recommend - RENAME USER
Altering mysql.user tables isn't something users should do. RENAME USER has existed for a long time, use this instead. Also change SpecificDNSorIp because DNS based grants are a horrible idea, fragile, and could be disabled with --skip-name-resolve. closes #536
1 parent 2a63ffd commit 0be85cb

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

mysqltuner.pl

+3-3
Original file line numberDiff line numberDiff line change
@@ -1892,16 +1892,16 @@ sub security_recommendations {
18921892
}
18931893

18941894
@mysqlstatlist = select_array
1895-
"SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE HOST='%'";
1895+
"SELECT CONCAT(QUOTE(user), '\@', host) FROM mysql.user WHERE HOST='%'";
18961896
if (@mysqlstatlist) {
18971897
foreach my $line ( sort @mysqlstatlist ) {
18981898
chomp($line);
18991899
my $luser = (split /@/, $line)[0];
19001900
badprint "User '" . $line. "' does not specify hostname restrictions.";
19011901
push( @generalrec,
1902-
"Restrict Host for '$luser'\@% to $luser\@SpecificDNSorIp" );
1902+
"Restrict Host for $luser\@% to $luser\@LimitedIPRangeOrLocalhost" );
19031903
push( @generalrec,
1904-
"UPDATE mysql.user SET host ='SpecificDNSorIp' WHERE user='" . $luser. "' AND host ='%'; FLUSH PRIVILEGES;" );
1904+
"RENAME USER $luser\@'%' TO " . $luser. "\@LimitedIPRangeOrLocalhost;" );
19051905
}
19061906
}
19071907

0 commit comments

Comments
 (0)