C.3. MySQL Permissions & Grant Tables
 | The following portion of documentation comes from my answer to an old discussion of Keystone, a cool product that does trouble-ticket tracking for IT departments. I wrote this post to the Keystone support group regarding MySQL grant table permissions, and how to use them effectively. It is badly in need of updating, as I believe MySQL has added a field or two to the grant tables since this time, but it serves as a decent introduction and troubleshooting document for grant table issues. I used Keynote to track my troubles until I discovered Bugzilla, which gave me a whole new set of troubles to work on : ) Although it is of limited use, it still has SOME use, thus it's still included. Please note, however, that I was a relatively new user to MySQL at the time. Some of my suggestions, particularly in how to set up security, showed a terrible lack of security-related database experience. |
From matt_barnson@singletrac.com Wed Jul 7 09:00:07 1999
Date: Mon, 1 Mar 1999 21:37:04 -0700
From: Matthew Barnson matt_barnson@singletrac.com
To: keystone-users@homeport.org
Subject: [keystone-users] Grant Tables FAQ
[The following text is in the "iso-8859-1" character set]
[Your display is set for the "US-ASCII" character set]
[Some characters may be displayed incorrectly]
Maybe we can include this rambling message in the Keystone FAQ? It gets
asked a lot, and the only option current listed in the FAQ is
"--skip-grant-tables".
Really, you can't go wrong by reading section 6 of the MySQL manual, at
http://www.mysql.com/Manual/manual.html. I am sure their description is
better than mine.
MySQL runs fine without permissions set up correctly if you run the mysql
daemon with the "--skip-grant-tables" option. Running this way denies
access to nobody. Unfortunately, unless you've got yourself firewalled it
also opens the potential for abuse if someone knows you're running it.
Additionally, the default permissions for MySQL allow anyone at localhost
access to the database if the database name begins with "test_" or is named
"test" (i.e. "test_keystone"). You can change the name of your database in
the keystone.conf file ($sys_dbname). This is the way I am doing it for
some of my databases, and it works fine.
The methods described below assume you're running MySQL on the same box as
your webserver, and that you don't mind if your $sys_dbuser for Keystone has
superuser access. See near the bottom of this message for a description of
what each field does.
Method #1:
1. cd /var/lib
#location where you'll want to run /usr/bin/mysql_install_db shell
script from to get it to work.
2. ln -s mysql data
# soft links the "mysql" directory to "data", which is what
mysql_install_db expects. Alternately, you can edit mysql_install_db and
change all the "./data" references to "./mysql".
3. Edit /usr/bin/mysql_install_db with your favorite text editor (vi,
emacs, jot, pico, etc.)
A) Copy the "INSERTr ancient and noble Native American tribe, but
instead derived its name from the fact that it was
"a patchy" version of the original
NCSA world-wide-web server.