Comments on: Use MySQL Without a Password (and Still be Secure) https://www.percona.com/blog/use-mysql-without-a-password/ Tue, 26 Dec 2023 19:16:41 +0000 hourly 1 https://wordpress.org/?v=6.5.2 By: Jan Steinman https://www.percona.com/blog/use-mysql-without-a-password/#comment-10971381 Mon, 04 Nov 2019 16:37:35 +0000 https://www.percona.com/blog/?p=63161#comment-10971381

I have no problem with people enabling this in a safe and confined environment

My database server is on a non-routable network (10.*.*.*). It is accessed by my web server via the same network, which also has a state IP facing the Internet.

I can access my LAN and MySQL via VPN, but otherwise, would you think this is a “safe and confined environment?”

]]> By: Art van Scheppingen https://www.percona.com/blog/use-mysql-without-a-password/#comment-10971378 Mon, 04 Nov 2019 10:51:46 +0000 https://www.percona.com/blog/?p=63161#comment-10971378 There isn’t that much changing compared to what you are describing: in your application you would still be required to use normal authentication. What Daniel is showing here is that in addition to the old scheme you can also use the Unix socket authentication. This means you will have just another way of authenticating of your Unix users than to put the password in some .my.cnf or mylogin.cnf. It’s basically saying you trust your Unix logins well enough to provide them passwordless access to MySQL, so your analogy of seeing Unix users as real human users is quite spot on.

Back when MariaDB announced to enable this by default for the root user in 10.4 I wrote a lengthy reply. I have no problem with people enabling this in a safe and confined environment, however I’m not convinced that enabling this _by default_ is a good idea as the majority installations will not be performed by sysadmins, security experts or DBAs. But I think this is a bit too off topic here.

]]> By: Jan Steinman https://www.percona.com/blog/use-mysql-without-a-password/#comment-10971377 Fri, 01 Nov 2019 18:43:46 +0000 https://www.percona.com/blog/?p=63161#comment-10971377 Cool!

But I’m not sure about the concept of UNIX users as SQL users.

For the most part, I think of UNIX users as real human users, whereas I think of MySQL users more as roles. I typically set up MySQL users as (for example) browsers (SELECT only) editors (SELECT, INSERT, DELETE, UPDATE), and admins (do anything).

It seems to me that user authentication happens at the application level, and role authentication takes place between the application and the database.

Or perhaps I completely miss what you were demonstrating.

]]>