librelist archives

« back to archive

mysql brew bind-address (security issue)

mysql brew bind-address (security issue)

From:
Joris Verschoor
Date:
2011-03-25 @ 19:00
Hello everybody,

I finished migrating from macports -> homebrew. Went fairly well (except 
for a missing pdftk port)

I have a small note about the mysql brew:
By default, the mysqld installed by brew listens on all interfaces. Which 
could be a security hole if there's one discovered in mysql, or when you 
have no / bad password for root. Most users only connect locally anyway 
(devbox etc), and thus should change

<key>Program</key>
<string>/usr/local/Cellar/mysql/5.5.10/bin/mysqld_safe 
--bind-address=127.0.0.1</string>

into:

 <key>ProgramArguments</key>
 <array>
   <string>/usr/local/Cellar/mysql/5.5.10/bin/mysqld_safe</string>
   <string>--bind-address=127.0.0.1</string>
 </array>


In the launchctl plist. After that, you should unload + load the plist



See 
http://www.hyperswitching.com/post/4088004710/secure-mysql-on-brew-homebrew-osx


Joris

Re: [homebrew] mysql brew bind-address (security issue)

From:
Mike McQuaid
Date:
2011-03-28 @ 19:59
On 25 Mar 2011, at 19:00, Joris Verschoor wrote:

> I have a small note about the mysql brew:
> By default, the mysqld installed by brew listens on all interfaces. 
Which could be a security hole if there's one discovered in mysql, or when
you have no / bad password for root. Most users only connect locally 
anyway (devbox etc), and thus should change

Can you file an issue about this instead? That's a better place for this 
discussion, thanks.

--
Mike McQuaid
http://mikemcquaid.com