User can't access a database

后端 未结 7 2272
太阳男子
太阳男子 2020-12-29 10:30

In my PHP script, I\'m accessing two databases db1 and db2. I have a user myuser@localhost that can access db1 but can\'

7条回答
  •  孤城傲影
    2020-12-29 11:00

    This very likely has nothing to do with GRANTs.

    A very common reason for having incorrect access rights is because of default users that exist in MySQL. Specially ones with '' for User (anonymous users) and/or Host in mysql.user table. Because of the way MySQL handles authentication and proxy users, and the sorting rules used on mysql.user table entries, one could end up using an unexpected user than the one they used for authentication.

    Use SELECT USER(); to find out the connecting user that was used during authentication and SELECT CURRENT_USER(); to find out the effective user whose privileges apply during the current session.

    And from http://dev.mysql.com/doc/refman/5.6/en/connection-access.html

    It is a common misconception to think that, for a given user name, all rows that explicitly name that user are used first when the server attempts to find a match for the connection. This is not true. If you are able to connect to the server, but your privileges are not what you expect, you probably are being authenticated as some other account.

    A mysql.user table similar to following

    +-----------+----------+-
    | Host      | User     | ...
    +-----------+----------+-
    | %         | root     | ... (root from any host)
    | %         | jeffrey  | ... (jeffrey from any host)
    | localhost | root     | ... (root from localhost)
    | localhost |          | ... (any user from localhost)
    +-----------+----------+-
    

    becomes,

    +-----------+----------+-
    | Host      | User     | ...
    +-----------+----------+-
    | localhost | root     | ...
    | localhost |          | ...
    | %         | jeffrey  | ...
    | %         | root     | ...
    +-----------+----------+-
    

    whenever the server reads the user table into memory, in order to handle multiple matches.
    When a client attempts to connect, the server looks through the rows in sorted order and uses the first row that matches the client host name and user name.
    Precedence is given as: values (IP address, host name, user name, etc.) > '%' > ''

    Most of the time application server/client is running in the same host as the database, causing the host name to be picked up as localhost during authentication.
    mysql -u jeffrey uses jeffrey@localhost which gets matched against ''@localhost instead of jeffrey@%.

    Executing $MYSQL_HOME/bin/mysql_secure_installation will remove anonymous users, while securing the installation, alleviating this unexpected behaviour.

    Also check:
    [1] http://bugs.mysql.com/bug.php?id=36576 (check comment before last)
    [2] http://bugs.mysql.com/bug.php?id=69570

提交回复
热议问题