MySQL User Privileges: Grant Dhiraj Kumar Jha callmedhiraj@gmail.com http://www.facebook.com/dhirajkumar.jha

Authentication and Authorization The terms Authorization and Authentication is usually used when there is tea-talk over database security. All database software (irrespective of vendors) has these features. Authentication: valid credentials (like host, username, password) Authorization: The privileges any user has when logged in to the system. The mysql client can take several arguments up front, including the user name, password, and hostname (computer name). You establish these arguments like so: mysql -u username -p [-h hostname] Using the Mysql Client Once you have successfully installed and started MySQL, you need some sort of way to interact with it. Whereas mysqld is the MySQL server that manages all the data, you need a client application that will talk to mysqld. The most common way to interface with mysqld besides using a programming language is to use the mysql client(or mysql monitor, as it is also called). This application can be used to connect to mysqld running on the same machine, or even on another.

The Command mysql –u root –p –h localhost

Users and Privileges After you have MySQL successfully up and running, and after you've established a password for the root user, it's time to begin adding other users. To improve the security of your databases, you should always create new users for accessing your databases, rather than continuing to use the root user at all times. The MySQL privileges system was designed to ensure proper authority for certain commands on specific databases. This technology is how a Web host, for example, can securely have several users accessing several databases, without concern. Each user within the MySQL system can have specific capabilities on specific databases from specific hosts (computers). The root userthe MySQL root user, not the system'shas the most power and is used for creating subusers, although subusers can be given root-like powers (inadvisably so).

Use any or combination of these. Privileges Use any or combination of these.

Admin Privileges List

Newer Privileges

SHOW GRANTS FOR 'llama'@'localhost'; // to list the privileges There are a handful of ways to establish users and privileges within MySQL, but the most failsafe is to use the mysql client and the GRANT command. The syntax goes like this: GRANT privileges ON database.* TO 'username'@'hostname' IDENTIFIED BY 'password‘ SHOW GRANTS FOR 'llama'@'localhost'; // to list the privileges Exit ; // to logout For the privileges aspect of this statement, you can list specific privileges or you can allow for all of them using ALL (which is not prudent). The database.* part of the statement specifies which database and tables the user can work on. You can name specific tables using database.tablename syntax or allow for every database with *.* (again, not prudent). Finally, you can specify the user name, the host, and a password. The user name has a maximum length of 16 characters. When creating a user name, be sure to avoid spaces (use the underscore instead) and note that user names are case-sensitive. The host name is the computer from which the user is allowed to connect. The most secure option is to set the host as localhost, meaning that the user can connect only from the same computer on which MySQL is running. The least secure is to use the wildcard character (%), meaning that any host is valid. You can also set the host name to be a specific IP address (192.168.0.1), an IP address within a certain realm (192.168.0.%), or a specific host name (mysite.com). Whatever you decide to do, it is the combination of a username@host that is important. If you create two usersJessica@apple and Jessica@bananathese are entirely different entities.

Deleting a user is as simple as running this command, which was added in MySQL 4.1: DROP USER username If what you'd rather do is just remove some privileges that a user has, you can use the REVOKE command. It works much like GRANT: REVOKE privileges ON database.* FROM 'username'@'host'

Other Security Recommendations Grant only the most minimal privileges necessary to each user. Avoid granting SUPER or PROCESS privileges unless absolutely necessary. Restrict FILE privilege to administrators. Always require a password for all users. Use good, secure passwords (non-dictionary words, incorporating numbers and symbols, mixed-capitalization, etc.).

Other Security Recommendations Besides, those recommendations, you should: Validate all data used in queries Watch for quotation marks and other problematic characters in queries.

Thank you