| 1 |
Alan McKinnon wrote: |
| 2 |
> On Monday 13 April 2009 22:10:20 Mick wrote: |
| 3 |
>> Hi All, |
| 4 |
>> |
| 5 |
>> I am not sure if I am alarming myself unnecessarily, but this is what I |
| 6 |
>> observed: |
| 7 |
>> |
| 8 |
>> Login as e.g. mick; (this is a unix acccount) |
| 9 |
>> mysql -u root -p |
| 10 |
>> Enter password: XXXXXX |
| 11 |
>> |
| 12 |
>> mysql> GRANT ALTER, CREATE, CREATE TEMPORARY TABLES, CREATE VIEW, INDEX, |
| 13 |
>> INSERT, SELECT, UPDATE ON database1.* TO 'db_user1'@'localhost' IDENTIFIED |
| 14 |
>> BY 'passwd1'; |
| 15 |
>> Query OK, 0 rows affected (0.00 sec) |
| 16 |
>> |
| 17 |
>> mysql> FLUSH PRIVILEGES; |
| 18 |
>> Query OK, 0 rows affected (0.00 sec) |
| 19 |
>> mysql>quit |
| 20 |
>> |
| 21 |
>> Now if I login into database1 as db_user1 and then press the up arrow key |
| 22 |
>> at the mysql> prompt I end up seeing all the previous commands that I ran |
| 23 |
>> as root, including the 'passwd1'!!! |
| 24 |
>> |
| 25 |
>> Isn't this a rather serious security problem? How could I do it |
| 26 |
>> differently? |
| 27 |
> |
| 28 |
> Not at all. What you are seeing when pressing the up arrow is not commands |
| 29 |
> stored by MySQl, but commands stored by your shell. It's complex to explain, |
| 30 |
> so bear with me: |
| 31 |
|
| 32 |
I don't know about complicated. |
| 33 |
|
| 34 |
cd |
| 35 |
more .mysql_history |
| 36 |
|
| 37 |
Works just like .bash_history |
| 38 |
|
| 39 |
kashani |
Archives