Re: % or machinename? Re: MySQL Admin win/Linux? when Server on linux

> Date: Thu, 8 Feb 2007 00:02:31 -0600 (CST)
> To: [email protected]
> From: Parul Jain <[email protected]>
> Subject: % or machinename? Re: MySQL Admin win/Linux? when Server on linux 
> Message-ID: <[email protected]>
> 
> Hi All
> 
> My setup is working now. Thanks for your helpful suggestions. I have 
> the Server on linux and GUI Tools on Windows XP connecting 
> successfully. Also created a user with privileges to connect from any 
> machine ( % instead of localhost in Grant). Now I dont have the error 
> 1130. 
> 
> One more question!
> Is it a very bad idea to give % ( instead of explicit machine ip 
> addresses from which user can connect to server) for all end-users so 
> that they can login from any computer with proper username and 
> password. ( Don't know which computers poeple would connect from.)

Depends on the privileges.

For mine, I'd try to be more restrictive. '%' is pretty wide open, since 
it includes the entire Internet - if you're in doubt about that, give me 
your server's public IP address, the username and password, and I'll 
leave my calling card in one of your tables. ;)

However, you can restrict users to a given subnet using '%' as *part* of 
the IP address. For instance, this statement allows anybody in the 
192.168.0.x subnet to connect and do a SELECT from any table:

GRANT SELECT ON *.* TO 'jon'@'192.168.0.%' IDENTIFIED BY 'jon';

So I can connect from 192.168.0.109, 192.168.0.24, 192.168.0.212, etc., 
but not from 192.168.1.100, 192.168.1.32, 192.168.2.217, 213.115.162.29, 
etc. Since all machines on my LAN have IP addresses starting with 
192.168.0, this keeps anybody who's not on my private network from 
logging in with that account, even if they know the username and password.

In fact, since all my machines have IP addresses between 192.1680.100 
and 192.168.0.200, I could do this instead, and restrict things a little 
more:

GRANT SELECT ON *.* TO 'jon'@'192.168.0.1__' IDENTIFIED BY 'jon';

(Note that there are 2 _ characters.)

Now 192.168.0.100 can connect using this account, but 192.168.0.10 and 
192.168.0.200 cannot.

See the discussion of the % and _ wildcards at 
http://dev.mysql.com/doc/refman/5.0/en/grant.html - it's about 1.3 of 
the way down the page, and see 
http://dev.mysql.com/doc/refman/5.0/en/string-comparison-functions.html 
for more about how % and _ work in pattern-matching.

cheers

jon.

> 
> Thanks to all of you for helpful suggestions. 
> 
> -parul



-- 

Jon Stephens - [email protected]
Technical Writer - MySQL Documentation Team
Brisbane, Australia (GMT +10.00)
Office: +61 (7) 3209 1394
Mobile: +61 402 635 784
MySQL AB: www.mysql.com


-- 
MySQL GUI Tools Mailing List
For list archives: http://lists.mysql.com/gui-tools
To unsubscribe:    http://lists.mysql.com/[email protected]