Securing A MySQL Install on Windows

The default install of MySQL on Windows allows users to:

  • Connect as root (with no password) from the localhost or any remote host. A root user can perform any operation to any database, even delete them.
  • Connect as an anonymous user (with no username or password). If you are connecting from localhost, you are allowed root privileges. Otherwise you are allowed to connect to any database whose name begins with "test"

This leaves your machine in a quite vulnerable state. At the least, you'll want to assign a password for the root user and delete the anonymous user privileges if they aren't necessary for your setup.

First, make sure mysql is running. Navigate to your mysql/bin directory (default is C:\mysql\bin) and click on winmysqladmin.exe. If it prompts you for a username and password, hit cancel.

Open up a command prompt and type in the following:

C:\mysql\bin>mysql -u root
mysql> USE mysql;
mysql> UPDATE user SET Password=PASSWORD('your_password') WHERE User='root';
mysql> FLUSH PRIVILEGES;

And to remove those anonymous user entries in the user table, connect to the server as root using your new password and delete the rows.

C:\mysql\bin>mysql -p -u root
mysql> USE mysql;
mysql> DELETE FROM user WHERE User='';
mysql> DELETE FROM db WHERE User='';
mysql> FLUSH PRIVILEGES;

Microsoft Windows 2000/XP - Windows cannot unload your registry file.

Is your Windows 2000 slow to shutdown and seems to hang for a really long time before is restarts? I had noticed on several machines that after i installed the routine windows security updates, it took forever for my machine to shutdown when i was running as a user with administrator privileges. It would hang for several minutes on the "Saving your settings..." dialog box.

Update: Windows Service Pack 4 has been released and fixes this problem. It is strongly recommended that you install the service pack rather than using this old hack.(see comments below)

Time for some testing. I wiped a hardrive on a laptop and reinstalled windows 2000. Everything was fine. Then one by one i installed the critical updates and tested them out. As soon as i installed the 329170: Security Update (Windows 2000) update, that's when the problem of long startup and shutdown times returned. Once i uninstalled this update, everything was working fine again. I downloaded and installed all the other updates.

To determine if you have the same problem as i did, do the following:

  1. On the taskbar at the bottom of your screen, click Start.
  2. Point to Settings, and then click Control Panel > Administrative Tools > Event Viewer.
  3. Click on Application Log.
    Look for an Error whose Source column is Userenv and Event column is 1000
  4. If you see this row, double-click on it to display the following dialog box:

Event Properties Dialog Box

How to Uninstall the Q329170 Hotfix

© 2007 Matt Westgate