<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="mysql-cluster-security-mysql-security-procedures">
      </a>
      25.6.21.3 NDB Cluster and MySQL Security Procedures
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045086914368">
  </a>
  <a class="indexterm" name="idm46045086912880">
  </a>
  <p>
   In this section, we discuss MySQL standard security procedures
        as they apply to running NDB Cluster.
  </p>
  <p>
   In general, any standard procedure for running MySQL securely
        also applies to running a MySQL Server as part of an NDB
        Cluster. First and foremost, you should always run a MySQL
        Server as the
   <code class="literal">
    mysql
   </code>
   operating system user;
        this is no different from running MySQL in a standard
        (non-Cluster) environment. The
   <code class="literal">
    mysql
   </code>
   system
        account should be uniquely and clearly defined. Fortunately,
        this is the default behavior for a new MySQL installation. You
        can verify that the
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   process is running
        as the
   <code class="literal">
    mysql
   </code>
   operating system user by using
        the system command such as the one shown here:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa26699881"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ps</span> aux | grep mysql
root     10467  0<span class="token punctuation">.</span>0  0<span class="token punctuation">.</span>1   3616  1380 pts/3    S    11<span class="token punctuation">:</span>53   0<span class="token punctuation">:</span>00 \
  /bin/sh <span class="token punctuation">.</span>/mysqld_safe <span class="token property">--ndbcluster</span> <span class="token constant">--ndb-connectstring</span><span class="token attr-value"><span class="token punctuation">=</span>localhost:1186</span>
mysql    10512  0<span class="token punctuation">.</span>2  2<span class="token punctuation">.</span>5  58528 26636 pts/3    Sl   11<span class="token punctuation">:</span>53   0<span class="token punctuation">:</span>00 \
  /usr/local/mysql/libexec/mysqld <span class="token constant">--basedir</span><span class="token attr-value"><span class="token punctuation">=</span>/usr/local/mysql</span> \
  <span class="token constant">--datadir</span><span class="token attr-value"><span class="token punctuation">=</span>/usr/local/mysql/var</span> <span class="token constant">--user</span><span class="token attr-value"><span class="token punctuation">=</span>mysql</span> <span class="token property">--ndbcluster</span> \
  <span class="token constant">--ndb-connectstring</span><span class="token attr-value"><span class="token punctuation">=</span>localhost:1186</span> <span class="token constant">--pid-file</span><span class="token attr-value"><span class="token punctuation">=</span>/usr/local/mysql/var/mothra.pid</span> \
  <span class="token constant">--log-error</span><span class="token attr-value"><span class="token punctuation">=</span>/usr/local/mysql/var/mothra.err</span>
jon      10579  0<span class="token punctuation">.</span>0  0<span class="token punctuation">.</span>0   2736   688 pts/0    S+   11<span class="token punctuation">:</span>54   0<span class="token punctuation">:</span>00 grep mysql</code></pre>
  </div>
  <p>
   If the
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   process is running as any other
        user than
   <code class="literal">
    mysql
   </code>
   , you should immediately shut
        it down and restart it as the
   <code class="literal">
    mysql
   </code>
   user. If
        this user does not exist on the system, the
   <code class="literal">
    mysql
   </code>
   user account should be created, and
        this user should be part of the
   <code class="literal">
    mysql
   </code>
   user
        group; in this case, you should also make sure that the MySQL
        data directory on this system (as set using the
   <a class="link" href="server-system-variables.html#sysvar_datadir">
    <code class="option">
     --datadir
    </code>
   </a>
   option for
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   ) is owned by the
   <code class="literal">
    mysql
   </code>
   user, and that the SQL node's
   <code class="filename">
    my.cnf
   </code>
   file includes
   <code class="literal">
    user=mysql
   </code>
   in the
   <code class="literal">
    [mysqld]
   </code>
   section. Alternatively, you can start the MySQL server process
        with
   <a class="link" href="server-options.html#option_mysqld_user">
    <code class="option">
     --user=mysql
    </code>
   </a>
   on the command
        line, but it is preferable to use the
   <code class="filename">
    my.cnf
   </code>
   option, since you might forget to
        use the command-line option and so have
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   running as another user
        unintentionally. The
   <a class="link" href="mysqld-safe.html" title="6.3.2 mysqld_safe — MySQL Server Startup Script">
    <span class="command">
     <strong>
      mysqld_safe
     </strong>
    </span>
   </a>
   startup
        script forces MySQL to run as the
   <code class="literal">
    mysql
   </code>
   user.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    Never run
    <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
     <span class="command">
      <strong>
       mysqld
      </strong>
     </span>
    </a>
    as the system root user.
          Doing so means that potentially any file on the system can be
          read by MySQL, and thus—should MySQL be
          compromised—by an attacker.
   </p>
  </div>
  <p>
   <a class="indexterm" name="idm46045086886960">
   </a>
   As mentioned in the previous section (see
   <a class="xref" href="mysql-cluster-security-mysql-privileges.html" title="25.6.21.2 NDB Cluster and MySQL Privileges">
    Section 25.6.21.2, “NDB Cluster and MySQL Privileges”
   </a>
   ), you
        should always set a root password for the MySQL Server as soon
        as you have it running. You should also delete the anonymous
        user account that is installed by default. You can accomplish
        these tasks using the following statements:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa36374745"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql">$<span class="token operator">&gt;</span> mysql <span class="token operator">-</span>u root

<span class="token prompt">mysql&gt;</span> <span class="token keyword">UPDATE</span> mysql<span class="token punctuation">.</span><span class="token keyword">user</span>
<span class="token prompt">    -&gt;</span>     <span class="token keyword">SET</span> <span class="token keyword">Password</span><span class="token operator">=</span><span class="token function">PASSWORD</span><span class="token punctuation">(</span><span class="token string">'<em class="replaceable">secure_password</em>'</span><span class="token punctuation">)</span>
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">User</span><span class="token operator">=</span><span class="token string">'root'</span><span class="token punctuation">;</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">DELETE</span> <span class="token keyword">FROM</span> mysql<span class="token punctuation">.</span><span class="token keyword">user</span>
<span class="token prompt">    -&gt;</span>     <span class="token keyword">WHERE</span> <span class="token keyword">User</span><span class="token operator">=</span><span class="token string">''</span><span class="token punctuation">;</span>

<span class="token prompt">mysql&gt;</span> <span class="token keyword">FLUSH</span> <span class="token keyword">PRIVILEGES</span><span class="token punctuation">;</span></code></pre>
  </div>
  <p>
   Be very careful when executing the
   <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
    <code class="literal">
     DELETE
    </code>
   </a>
   statement not to omit the
   <code class="literal">
    WHERE
   </code>
   clause, or you risk deleting
   <span class="emphasis">
    <em>
     all
    </em>
   </span>
   MySQL users. Be sure to run the
   <a class="link" href="flush.html#flush-privileges">
    <code class="literal">
     FLUSH PRIVILEGES
    </code>
   </a>
   statement as
        soon as you have modified the
   <code class="literal">
    mysql.user
   </code>
   table, so that the changes take immediate effect. Without
   <a class="link" href="flush.html#flush-privileges">
    <code class="literal">
     FLUSH PRIVILEGES
    </code>
   </a>
   , the changes do
        not take effect until the next time that the server is
        restarted.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    <a class="indexterm" name="idm46045086871184">
    </a>
    <a class="indexterm" name="idm46045086869696">
    </a>
    Many of the NDB Cluster utilities such as
    <a class="link" href="mysql-cluster-programs-ndb-show-tables.html" title="25.5.27 ndb_show_tables — Display List of NDB Tables">
     <span class="command">
      <strong>
       ndb_show_tables
      </strong>
     </span>
    </a>
    ,
    <a class="link" href="mysql-cluster-programs-ndb-desc.html" title="25.5.9 ndb_desc — Describe NDB Tables">
     <span class="command">
      <strong>
       ndb_desc
      </strong>
     </span>
    </a>
    , and
    <a class="link" href="mysql-cluster-programs-ndb-select-all.html" title="25.5.25 ndb_select_all — Print Rows from an NDB Table">
     <span class="command">
      <strong>
       ndb_select_all
      </strong>
     </span>
    </a>
    also work without
          authentication and can reveal table names, schemas, and data.
          By default these are installed on Unix-style systems with the
          permissions
    <code class="literal">
     wxr-xr-x
    </code>
    (755), which means
          they can be executed by any user that can access the
    <code class="filename">
     mysql/bin
    </code>
    directory.
   </p>
   <p>
    See
    <a class="xref" href="mysql-cluster-programs.html" title="25.5 NDB Cluster Programs">
     Section 25.5, “NDB Cluster Programs”
    </a>
    , for more
          information about these utilities.
   </p>
  </div>
 </div>
 <br/>
</div>
