2 
+-----------+------------------+-------------------------------------------+
| host      | user             | password                                  |
+-----------+------------------+-------------------------------------------+
| localhost | root             | *bunch of gibberish                       |
| localhost | phpmyadmin       | *bunch of gibberish                       |
| 127.0.0.1 | root             | *bunch of gibberish                       |
| ::1       | root             | *bunch of gibberish                       |
| localhost | debian-sys-maint | *bunch of gibberish                       |
+-----------+------------------+-------------------------------------------+

So I did use mysql; and then select host, user, password from user;

It seems like there are multiple roots, a phpmyadmin, a debian-sys-maint, etc. Is this normal? Should I be deleting any of these?

Improve this question

1 Answer 1

Reset to default
3

There's three entries there because you need one entry for each user@host combination.

Examine host for each of the root user entries. The host column defines where that user can connect from and have the connection accepted. In this case, for the root user, the host entries are localhost, 127.0.0.1, and ::1. The last two are IPv4 and IPv6 entries for the local machine loopback interface (lo in ifconfig) respectively. The localhost entry is the hostname representation of both of those IP entries.

It's fine to leave all three there. It just makes sure that you can still access the root user from the local system in the event that your /etc/hosts file goes weird and localhost no longer resolves to your own box.

The only thing you really need to be concerned about is if a root user on MySQL has an entry for any host entry OTHER than localhost, 127.0.0.1, and ::1. That could indicate a security risk.

And the debian-sys-maint account is used for log rotating and things, and just like the root account can only be used via localhost in a default setup, so you don't need to really worry about that one either.

Improve this answer
8
  • What about debian-sys-maint? Also when would localhost ever not resolve to my own box?
    – user51819
    Jul 3, 2014 at 2:17
  • @user51819 debian-sys-maint is used by the operating system, for logfile stuff (see this), and you can leave it there as well.
    – Thomas Ward ♦
    Jul 3, 2014 at 2:18
  • 1
    But if I were a hacker, wouldn't I try to exploit some sort of security hole by taking advantage of a default account like debian-sys-maint?
    – user51819
    Jul 3, 2014 at 2:19
  • @user51819 You need to leave that user in the system in order to let logrotate rotate the log files. Besides, you need to again look at the host entry. It only works from localhost. If a hacker has broken into your system and has access to localhost there's a LOT more to worry about than your MySQL database. The default users have been looked at by the security team for consideration of that, anyways, root has to exist for MySQL to exist. debian-sys-maint, to my knowledge, only can work with logfiles, but don't quote me on that.
    – Thomas Ward ♦
    Jul 3, 2014 at 2:20
  • Ah, I misunderstood the point of the "host" component. That means that particular user can only work if the host of the person logged in is localhost? So that would imply the only way someone could be using these accounts is to somehow gain root (e.g. SSHing into my box or something)
    – user51819
    Jul 3, 2014 at 2:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .