On MySql Is it possible to GRANT Select to ALL users? - mysql

Question

My question is simple, can I GRANT permission to ALL (as in any user with any pwd coming from any machine) users ?
I know it COULD BE problematic in some cases. But ours is a demo database, with users unknown. So please spare us the rod.
From what I know and what I have tried the Answer is NO, we can not do it. I am posting this question to confirm my understanding.
AFAIK, we can't. Is there a way to hack around this ?

Answer 1

As people have said in the comments - this is probably a bad idea. But, I thought, why not have a crack and see how it can be done.
The most simple place to start would be to create a MySQL user without a username:
GRANT ALL ON *.* TO ''#'%' IDENTIFIED BY '';
This will let you login with any username - and a blank password. This might be what some people are looking for - but it sounds like you want any username any password.
To do that - I suggest using mysql-proxy. I would download the source code. If you're on Ubuntu then you will need the following packages to build it:
apt-get install libmysqlclient-dev \
pkg-config \
lua5.1 liblua5.1-0-dev liblua5.1-0 \
libglib2.0-dev \
libevent-1.4-2 libevent1-dev
If you do compile it then you'll need to run /sbin/ldconfig afterwards as root.
Then we can write a lua script to set the username and password for every connection. The mysql-proxy client has some example scripts, but the relevant examples/tutorial-scramble.lua file is old and doesn't work with the current version. You can use the following script:
local CLIENT_PROTOCOL_41 = 512 -- New 4.1 protocol
local CLIENT_SECURE_CONNECTION = 32768 -- New 4.1 authentication
local MYSQL_AUTH_CAPABILITIES = ( CLIENT_PROTOCOL_41 + CLIENT_SECURE_CONNECTION )
local password = assert(require("mysql.password"))
local proto = assert(require("mysql.proto"))
function read_auth()
local c = proxy.connection.client
local s = proxy.connection.server
local challenge = (s.scramble_buffer):sub(1,20)
local default_username = "foo"
local default_password = "bar"
proxy.queries:append(1,
proto.to_response_packet({
username = default_username,
response = password.scramble(challenge, password.hash(default_password)),
charset = 8, -- default charset
database = c.default_db,
max_packet_size = 1 * 1024 * 1024,
server_capabilities = MYSQL_AUTH_CAPABILITIES
})
)
return proxy.PROXY_SEND_QUERY
end
Save this as any-user-any-pass.lua or something. Then you will need to create the user in the database which I refer to in the script (username foo, password bar):
GRANT ALL ON *.* TO 'foo'#'localhost' IDENTIFIED BY 'bar';
Then we can start up mysql-proxy - we will connect it to the local mysql server on port 3306 and it will listen on port 3307. Use a command similar to this:
mysql-proxy --proxy-lua-script=`pwd`/any-user-any-pass.lua \
--proxy-backend-addresses=localhost:3306 \
--proxy-address=localhost:3307
Test it out in a different terminal:
ubuntu#test:~$ mysql -h 127.0.0.1 -P 3306 -u ANYTHING -pSOMETHING
ERROR 1045 (28000): Access denied for user 'ANYTHING'#'localhost' (using password: YES)
ubuntu#test:~$ mysql -h 127.0.0.1 -P 3307 -u ANYTHING -pSOMETHING
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 752
Server version: 5.5.29-0ubuntu1 (Ubuntu)
Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> SELECT CURRENT_USER();
+----------------+
| CURRENT_USER() |
+----------------+
| foo#localhost |
+----------------+
1 row in set (0.00 sec)
mysql>
As you can see - first I test connecting straight to MySQL - it rejects the ANYTHING/SOMETHING credentials. Then I connect to the MySQL proxy on 3307 and it lets me straight in because the lua script is changing the username and password the connection is using.