Some experiences on mysql security issues (Anonymous Users)

When I helped my friend sort out his home page space two days ago, I found some issues that may be ignored by mysql:
We know that after MySQL is installed, it will automatically create a root user and an anonymous user. The initial password is empty. For the former, many references will remind you to set a password in time, and ignore the latter, probably because the latter is set to only be used on the local machine by default.

However, if your mysql database is to be provided to the web server for database services, the cost of ignoring this anonymous user may be quite high, because in the default settings, this anonymous user has almost the same permissions as root on localhost. At this time, if your customer has the permission to upload script files and script files, you can perform mysql database operations (for example, allow mysql php operations) you may have changed your MySQL account:

When I helped my friend sort out his home page space today, I tried to write a simple PHP file for SQL statement execution and upload it. I tried to leave the user and password in the connection word empty, host = localhost. The result shows that My SQL statement can be executed, so select * from mysql is executed. the user checks the user's permissions and finds that the user has a high permission on localhost, even grant_priv. (During the inspection, the user will find that there are two lines of usernames and passwords with blank passwords under the root user, however, if the permissions are y/n, the anonymous user's local and remote permissions are set)

So I tried to use this php page to create a new user and grant him higher permissions, in this way, I can use this new user to connect to the mysql server of this website through the mysql client of my local machine, and manage the mysql server of this website with the management permissions of this new user, I can see that I can easily obtain in-depth database operations. How can I put sensitive information on my friend's homepage space into this mysql server?

Suggestions for improvement:
1. After mysql is installed, not only the password of the root user is changed, but also the password of the anonymous user is changed. The method is similar to changing the password of the root user:
Mysql> Update user SET Password = PASSWORD (yournewpassword) where user = /;
Mysql> flush privileges;
2. If not necessary, delete this anonymous user so that all users must provide the user name for using MySQL. Even if there is a problem after the day, it is easy to find the source of the problem.
3. Except for the root user, other users, including anonymous users (if the user is not deleted), should not have the grant permission to prevent the spread of uncontrolled management permissions.
4. When you grant update, delete, alert, create, and drop permissions to a user, you must restrict the permission to a specific database. In particular, you must avoid having normal customers the permission to operate on the MySQL database, otherwise, your system settings may be replaced.
5. Check the mysql. User table and cancel unnecessary shutdown_priv, reload_priv, process_priv, and file_priv permissions. These permissions may leak more server information including non-mysql information.
6. If you do not want your users to use the MySQL database, re-set or compile your php when providing script languages such as PHP to cancel their default support for MySQL.

From: Very Linux