9

Title sums it up. I'm setting up a dedicated server as opposed to using shared hosting, and am wondering if it's more secure to change the MySQL root username. I've gone for a long and complex password, and I've done my best to secure the server itself using key based SSH and disabling root logins etc. But I'm paranoid since it's totally my responsibility now and I figure that if root is renamed, it makes it harder for a hacker to try and brute force if they don't know the username. Disabling remote access is probably helpful as well, if an option.

I saw this question: https://serverfault.com/questions/148801/when-securing-mysql-is-it-better-to-create-a-user-with-root-like-priviliges-and and the accepted answer was to rename root, but there wasn't much discussion.

What do you do and why?

Improve this question
1
  • A middle point between disabling remote access and allowing remote access is using a VPN and allowing VPN access but not regular network access.
    – this.josh
    Commented Sep 4, 2011 at 18:31

3 Answers 3

Reset to default
10

Anytime you deviate from a standard install, there's a cost: You need to adjust your mind and tools to deal with the deviation. Precious seconds or minutes may be wasted in critical situations because no one else in the world uses fiddledimdunk as their MySQL root user.

Debian and others rename their MySQL user and that works best if you're running an all-Debian platform.

I've seen people fiddle with their .ssh/config for an hour to get chained ssh connctions working between jump-hosts because they moved sshd to a different port.

If you have a tool that lets you manage everything you need to, and you never need to manually log into your MySQL instance, it might be worth it for you, but I very much doubt it.

Instead, use that strong password you talked about and throw your log analysers at MySQL to detect anything odd going on.

Improve this answer
3
  • I'd never really thought about the mental cost of deviating from standard. Good point.
    – Biggles
    Commented Sep 3, 2011 at 15:57
  • This is an good example of keeping security simple. You want to make the process easy for the authorized users and concentrate security in as few points as possible. i.e. make the username standard and the password hard. Using muti-factor authentication is a good idea too.
    – this.josh
    Commented Sep 4, 2011 at 18:29
  • 2
    How did you know my MySQL root username was fiddledimdunk!
    – symcbean
    Commented Sep 5, 2011 at 11:46
4

I would make sure the password is something long and obscure (which you mentioned you already have) and then disable remote root access, or at the least specify the IP's for root access. You have said you have key based SSH so if you need root access you can SSH in and then use root from there. Then create users with only the required access as needed, lock it down and open as needed :)

Regards Dan

Improve this answer
3

If the server is run and owned by you and you are not planning on delegating any responsibility's regarding administration duty's etc to another party who may need to know such information as the newly renamed 'root' I don't see the problem with renaming or indeed, removing it all together in replace of another user with root like permissions. It all depends on your situation and how happy you are when it comes down to the crunch when during a critical-time do actually forget the newly renamed default 'root' user name.

Another point that maybe obvious but will say it anyway; others may depend on your 'root' account actually being called 'root' and not some renamed entity like 'rewt' for example if you make any kind of use of remote scripts (or whatever) which may depend on specifically calling of the 'root' account..

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .