Public SourceMage Discussion List

[Spencer Ogden <spencero AT mail.utexas.edu>]

Um... You should set a password? What else?

On Sunday 13 October 2002 03:47 pm, David Pradier wrote:
> Hi, i just ran a nessus on my localhost to see if i had any
> vulnerability.
>
> Here is what it said me:
> --------------------------------------------------------
> Your MySQL database is not password protected.
>
> Anyone can connect to it and do whatever he wants to your data
> (deleting a database, adding bogus entries, ...)
> We could collect the list of databases installed on the remote host :
>
> . mysql
> . test
>
> Solution : Log into this host, and set a password for the root user
> through the command 'mysql -u root password <newpassword>'
> Read the MySQL manual (available on www.mysql.com) for details.
> In addition to this, it is not recommanded that you let your MySQL
> daemon listen to request from anywhere in the world. You should filter
> incoming connections to this port.
>
> Risk factor : High
> ---------------------------------------------------------
>
> Well...
> I didn't installed and tweaked mysql myself ; i guess i installed it as
> a dependency to have i dunno which additional service in i dunno which
> piece of software.
>
> But...
> It remains that i have a hole.
> What do you think about it concerning what i should do, and what it
> implies for the distro ?
>
> day
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss