510496 - Recommend the admin to run mysql_secure_installation rather than playing with command lines

Status: RESOLVED FIXED

(Bugzilla :: Documentation, defect)

Description

[Frédéric Buclin]

Attachment: patch, v1

MySQL 4.1 and newer all have a great tool named mysql_secure_installation which does exactly what we wrote in the documentation, i.e. recommend to set a password for root, remove the anonymous account, and disable the network access if it's located on the same machine as the web server. On Windows, the installer offers you the same capabilities (with a nice GUI).

Rather than suggesting the admin to do security stuff from the command-line (with the risk that he does something wrong), we should rather recommend him to run this tool (on Windows, this is automatically done when running the installer).

Comment 1

[Colin Ogilvie [:cso]]

Comment on attachment 394498 [details] [diff] [review]
patch, v1

My gut says the first section would be better worded as:

"We highly recommend that you run <filename>mysql_secure_installation</filename> on Linux or the MySQL installer on Windows, and follow the instructions. Important points to note are:
1) be sure that the root account has a secure password set
2) Do not create an anonymous account, and it it exists, say 'yes' to remove it.
3) If your web server and MySQL server are on the same machine, you should disable the network access."

The items in 1,2 and 3 should probably also be a list, too rather than just part of the paragaph. 

Note that I've added the word 'secure' to the root password section, just in case someone sets it to 'password' or something, which doesn't really help IMO.

Comment 2

[David Lawrence [:dkl]]

Comment on attachment 394498 [details] [diff] [review]
patch, v1

>Index: docs/en/xml/installation.xml
>===================================================================
>RCS file: /cvsroot/mozilla/webtools/bugzilla/docs/en/xml/installation.xml,v
>retrieving revision 1.170
>diff -3 -p -u -r1.170 installation.xml
>--- docs/en/xml/installation.xml	13 Aug 2009 21:43:13 -0000	1.170
>+++ docs/en/xml/installation.xml	14 Aug 2009 13:46:35 -0000
>@@ -736,8 +736,12 @@
>         <caution>
>           <para>
>             MySQL's default configuration is very insecure.
>-            <xref linkend="security-mysql"/> has some good information for
>-            improving your installation's security.
>+            We highly recommend to run <filename>mysql_secure_installation</filename>
>+            on Linux or the MySQL installer on Windows and to follow instructions.
>+            Important points are: 1) be sure that the root account has a password
>+            set, 2) do not create an anonymous account, and if it exists, say "yes"
>+            to remove it, 3) if your web server and your MySQL server are on the
>+            same machine, you can safely disable the network access.
>           </para>
>         </caution>

I concur that the important points should be represented as a list instead of part of the paragraph itself.

<orderedlist>
  <listitem>
    Be sure that the root account has a password set.
  </listitem>
  <listitem>
    Do not create an anonymous account, and if it exists, say "yes" to remove it.
  </listitem>
  <listitem>
    If your web server and your MySQL server are on the
    same machine, you can safely disable the network access.
  </listitem>
</orderedlist>

>@@ -745,11 +749,11 @@
>           <title>Allow large attachments and many comments</title>
>           
>           <para>By default, MySQL will only allow you to insert things
>-          into the database that are smaller than 64KB. Attachments
>+          into the database that are smaller than 1MB. Attachments
>           may be larger than this. Also, Bugzilla combines all comments
>           on a single bug into one field for full-text searching, and the
>-          combination of all comments on a single bug are very likely to
>-          be larger than 64KB.</para>
>+          combination of all comments on a single bug could in some cases
>+          be larger than 1MB.</para>
>           
>           <para>To change MySQL's default, you need to edit your MySQL
>           configuration file, which is usually <filename>/etc/my.cnf</filename>

Is this supposed to be in this patch? Seems unrelated to this bug.

Dave

Comment 3

[Frédéric Buclin]

(In reply to comment #2)
> Is this supposed to be in this patch? Seems unrelated to this bug.

Yes, it's part of the cleanup about MySQL instructions.

Comment 4

[Frédéric Buclin]

Attachment: patch, v2

Per Colin's comments.

Comment 5

[David Lawrence [:dkl]]

Comment on attachment 394941 [details] [diff] [review]
patch, v2

Looks good and generated html/txt looks correct. r=dkl

Comment 6

[Frédéric Buclin]

tip:

Checking in docs/en/xml/glossary.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/glossary.xml,v  <--  glossary.xml
new revision: 1.26; previous revision: 1.25
done
Checking in docs/en/xml/installation.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/installation.xml,v  <--  installation.xml
new revision: 1.171; previous revision: 1.170
done
Checking in docs/en/xml/security.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/security.xml,v  <--  security.xml
new revision: 1.20; previous revision: 1.19
done


3.4.1:

Checking in docs/en/xml/glossary.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/glossary.xml,v  <--  glossary.xml
new revision: 1.25.6.1; previous revision: 1.25
done
Checking in docs/en/xml/installation.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/installation.xml,v  <--  installation.xml
new revision: 1.165.2.5; previous revision: 1.165.2.4
done
Checking in docs/en/xml/security.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/security.xml,v  <--  security.xml
new revision: 1.19.4.1; previous revision: 1.19
done


3.2.4:

Checking in docs/en/xml/glossary.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/glossary.xml,v  <--  glossary.xml
new revision: 1.25.2.1; previous revision: 1.25
done
Checking in docs/en/xml/installation.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/installation.xml,v  <--  installation.xml
new revision: 1.157.2.11; previous revision: 1.157.2.10
done
Checking in docs/en/xml/security.xml;
/cvsroot/mozilla/webtools/bugzilla/docs/en/xml/security.xml,v  <--  security.xml
new revision: 1.18.2.1; previous revision: 1.18
done