Tuesday, December 21, 2010

Add skip-name-resolve to default my.cnf

Copying and pasting myself from an entry in the bugzilla system:

Description of problem:

The default mysql setup (/etc/my.cnf) indicates to make an inverse dns lookup
for new network connections. Mostly this is a quite primitive way to strength
database security (IMHO it provides no added security at all) but promotes
buggy behaviour and is quite risky. For example mysql connections will fail if
DNS fails. Even if it works, connections will really slow down (around x100
times slower!!) if using an external DNS or the DNS is overloaded.

Other potencial problems. After granting access with the command:

GRANT ALL PRIVILEGES ON *.* TO 'myuser'@'%' IDENTIFIED BY 'MyPassword' WITH
GRANT OPTION;

connections will be allowed to 'myuser' from any host, EXCEPT from localhost
(127.0.0.1). An extra command will be needed.

GRANT ALL PRIVILEGES ON *.* TO 'myuser'@'%' IDENTIFIED BY 'MyPassword' WITH
GRANT OPTION;

What's much worse. Allowed connections can stop working if suddenly /etc/hosts
is altered. (That really hurts in production environments).

No comments: