Does MySQL require a shell?

redleg7 · 10-07-2008, 06:31 AM

I have MySQL running on several servers. In looking at /etc/passwd, I noticed that the mysql system account has a shell (i.e., /bin/bash). Is this necessary or, for security, should I change it to /sbin/nologin?

bkcreddy17 · 10-07-2008, 07:43 AM

Don't change to nologin shell. If you change the user can't login to mysql.
for example:

Code:

$mysql -u jane -pXXXXX

jschiwal · 10-07-2008, 08:19 AM

Code:

> cat /etc/passwd | grep mysql
mysql:x:60:110:MySQL database admin:/var/lib/mysql:/bin/false
> sudo sed -n '/mysql/p' /etc/shadow
mysql:!:14051:0:99999:7:::

On my desktop, /bin/false is used for the shell. The password you enter in the mysql command is encrypted to a hash value and compared against a value in the mysql.user table. You may have for example an "amarok" user that the amarok program uses if you use the mysql backend. There won't be an amorok linux user. You have a "root" user in mysql. You just need to use "mysql -h hostname -u root -p" to log in to mysql. You shouldn't use "sudo mysql ..." to run the client as root. You just need to use the "root" mysql user. The password you use for access doesn't need to be the same as the regular login password.

redleg7 · 10-08-2008, 06:06 AM

Since I did not create this account, I believe that the mysql account is created by default during installation of MySQL. I agree that if I am creating an account on the server for a user, that changing the shell to /sbin/nologin will prevent that user from logging on to the server and subsquently from connecting to the MySQL database. This is exactly how most system accounts are handled (FYI, the mysql account on my server has an uid of 79 which, since it is less than 500, marks it as an system account; at least that is my understanding of uid's). However, in this case, mysql is not a user account that should be acessing the server via a logon. I have created local user accounts on the server which are given a shell and allowed to logon. In turn these accounts are provided limited access to specific MySQL database(s) as needed. In looking at the previous postings, it seems that for this case, I should change the shell to /sbin/nologin. Is this correct? (Sorry if I was not through enough during the first posting).

jschiwal · 10-09-2008, 02:22 AM

I would change the default shell for the mysql system user. Users of the mysql database don't need to have login accounts on the mysql server. There doesn't need to be any regular users at all*. The usernames and passwords are obtained from the database itself:
Log in as root to the mysql database and enter:
SELECT Host, User, Password FROM user;

Code:

| localhost     | root       | *6666666666666666666666666666666666666666 |
| hpmedia       | root       | *6666666666666666666666666666666666666666 |
| 127.0.0.1     | root       | *6666666666666666666666666666666666666666 |
...

As a friendly reminder, make sure that you don't have blank entries in the password field (null passwords). That is how the root password is just after installing mysql. The first thing you should do is give the root account a password. There are also two demo tables with global access that you may want to delete. See the mysql manual. There is a section on securing the server just after installation.

*Well, maybe a user account that you use to log into before suing to root if you are an administrator, and a user account for the admin with permissions to perform backups (read access to all files).