Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove recommendation Restrict Host for 'root'@% to root@SpecificDNSorIp #536

Closed
grooverdan opened this issue Jan 28, 2021 · 1 comment · Fixed by #543
Closed

remove recommendation Restrict Host for 'root'@% to root@SpecificDNSorIp #536

grooverdan opened this issue Jan 28, 2021 · 1 comment · Fixed by #543

Comments

@grooverdan
Copy link
Contributor

Reasons for removal:

  • container environment pretty much exclusively use '%' for grants and the network isn't known (by mysql/mariadb container producers), and even a local environment would keen it this way and apply limits in their docker swarm or kubernetes configuraiton.

    UPDATE mysql.user SET host ='SpecificDNSorIp' WHERE user='root' AND host ='%'; FLUSH PRIVILEGES;

Why this is a horrible suggestion (to which detailed, but incomplete, work around can be written if still desired):

  • Procedures, events, triggers, functions (and possibly others) objects connected to root@% become instantly invalid.
  • Encourages too much direct manipulation of mysql system tables.
  • Won't work on MariaDB-10.4+
@grooverdan
Copy link
Contributor Author

seems I've missed the existence of https://dev.mysql.com/doc/refman/5.6/en/rename-user.html which solves all but the container environment cases.

grooverdan added a commit to grooverdan/MySQLTuner-perl that referenced this issue Feb 4, 2021
Altering mysql.user tables isn't something users should do.

RENAME USER has existed for a long time, use this instead.

Also change SpecificDNSorIp because DNS based grants are
a horrible idea, fragile, and could be disabled with
--skip-name-resolve.

closes major#536
@grooverdan grooverdan mentioned this issue Feb 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant