Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Server Installation

|

243

mysql -u root

...

mysql> update user set user = 'admin' where user = 'root';

Although Linux has many tools to improve the security of its user accounts—includ-

ing a minimum password length, account expirations, login rejection after repeated

failures, and password look-ups in dictionaries—MySQL does none of these for its

database accounts. Also, MySQL’s fast login process enables a cracker to automate

fast password attacks. Passwords are stored as an MD5 hash rather than the original

text, so dictionary attacks using precomputed MD5 hashes of common passwords

are a threat.

If you want to ensure that your passwords are good enough, some MySQL password

crackers are:

• http://packetstormsecurity.nl/Crackers/mysqlpassword.c

• http://www.openwall.com/john/contrib/john-1.6-mysql-1.diff

Deleting Anonymous Users and Test Databases

Out of the box, MySQL has a test database and some phantom users that leave open

potential risks. Let’s whack them. Now that you have a MySQL root user password,

you’ll be prompted for it:

% mysql -u root -p

Enter password:

Welcome to the MySQL monitor. Commands end with ; or \g.

Your MySQL connection id is 8 to server version: 3.23.58

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>use mysql;

Database changed

mysql>delete from user ...