Public SourceMage Discussion List

[David Pradier <pradierdavid AT yahoo.fr>]

Hi, i just ran a nessus on my localhost to see if i had any vulnerability.

Here is what it said me:
--------------------------------------------------------
Your MySQL database is not password protected.

Anyone can connect to it and do whatever he wants to your data
(deleting a database, adding bogus entries, ...)
We could collect the list of databases installed on the remote host :

. mysql
. test

Solution : Log into this host, and set a password for the root user
through the command 'mysql -u root password <newpassword>'
Read the MySQL manual (available on www.mysql.com) for details.
In addition to this, it is not recommanded that you let your MySQL
daemon listen to request from anywhere in the world. You should filter
incoming connections to this port.

Risk factor : High
---------------------------------------------------------

Well...
I didn't installed and tweaked mysql myself ; i guess i installed it as a 
dependency to have i dunno which additional service in i dunno which piece of 
software.

But...
It remains that i have a hole.
What do you think about it concerning what i should do, and what it implies 
for the distro ?

day