Skip to content

Commit 2f45f34

Browse files
committed
anonymous users - remove password checks
For anonymous users, those with user='', having a recommendation to set their passwords, and warning that the password is the same as the username is a little excessive since there's already a recommendation to drop the user. So let's remove those recommendation so we don't see: [!!] User '@localhost' has user name as password. [!!] User '@localhost.localdomain' has user name as password. or: Set up a Secure Password for @localhost user: SET PASSWORD FOR ''@'SpecificDNSorIp' = PASSWORD('secure_password'); Set up a Secure Password for @localhost.localdomain user: SET PASSWORD FOR ''@'SpecificDNSorIp' = PASSWORD('secure_password'); Lets keep the focus on: -------- Security Recommendations ------------------------------------------------------------------ [!!] User ''@'localhost' is an anonymous account. Remove with DROP USER ''@'localhost'; [!!] User ''@'localhost.localdomain' is an anonymous account. Remove with DROP USER ''@'localhost.localdomain';
1 parent 9a9ff55 commit 2f45f34

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

mysqltuner.pl

+4-2
Original file line numberDiff line numberDiff line change
@@ -1819,12 +1819,14 @@ sub security_recommendations {
18191819
if ( mysql_version_ge(10, 4) ) {
18201820
@mysqlstatlist = select_array
18211821
q{SELECT CONCAT(user, '@', host) FROM mysql.global_priv WHERE
1822-
JSON_CONTAINS(Priv, '"mysql_native_password"', '$.plugin') AND JSON_CONTAINS(Priv, '""', '$.authentication_string')
1822+
user != ''
1823+
AND JSON_CONTAINS(Priv, '"mysql_native_password"', '$.plugin') AND JSON_CONTAINS(Priv, '""', '$.authentication_string')
18231824
AND NOT JSON_CONTAINS(Priv, 'true', '$.account_locked')};
18241825
}
18251826
else {
18261827
@mysqlstatlist = select_array
18271828
"SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE ($PASS_COLUMN_NAME = '' OR $PASS_COLUMN_NAME IS NULL)
1829+
AND user != ''
18281830
/*!50501 AND plugin NOT IN ('auth_socket', 'unix_socket', 'win_socket', 'auth_pam_compat') */
18291831
/*!80000 AND account_locked = 'N' AND password_expired = 'N' */";
18301832
}
@@ -1852,7 +1854,7 @@ sub security_recommendations {
18521854

18531855
# Looking for User with user/ uppercase /capitalise user as password
18541856
@mysqlstatlist = select_array
1855-
"SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(CONCAT(UPPER(LEFT(User, 1)), SUBSTRING(User, 2, LENGTH(User))))";
1857+
"SELECT CONCAT(user, '\@', host) FROM mysql.user WHERE user != '' AND (CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(user) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(UPPER(user)) OR CAST($PASS_COLUMN_NAME as Binary) = PASSWORD(CONCAT(UPPER(LEFT(User, 1)), SUBSTRING(User, 2, LENGTH(User)))))";
18561858
if (@mysqlstatlist) {
18571859
foreach my $line ( sort @mysqlstatlist ) {
18581860
chomp($line);

0 commit comments

Comments
 (0)