From owner-freebsd-questions@FreeBSD.ORG Thu Feb 3 11:46:47 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AB6CE16A4CE for ; Thu, 3 Feb 2005 11:46:47 +0000 (GMT) Received: from server1.ultratrends.com (S01060004e20310fa.rd.shawcable.net [70.65.87.221]) by mx1.FreeBSD.org (Postfix) with ESMTP id C10B243D5A for ; Thu, 3 Feb 2005 11:46:46 +0000 (GMT) (envelope-from technical@ultratrends.com) Received: from server1.ultratrends.com (localhost [127.0.0.1]) j13BkjG7065479; Thu, 3 Feb 2005 04:46:45 -0700 (MST) (envelope-from trodat@server1.ultratrends.com) Received: from localhost (trodat@localhost)j13Bkjgm065476; Thu, 3 Feb 2005 04:46:45 -0700 (MST) (envelope-from trodat@server1.ultratrends.com) Date: Thu, 3 Feb 2005 04:46:44 -0700 (MST) From: Technical Director To: Ted Mittelstaedt In-Reply-To: Message-ID: <20050203043020.Q65437@server1.ultratrends.com> References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Milter: Spamilter (Reciever: server1.ultratrends.com; Sender-ip: 127.0.0.1; Sender-helo: server1.ultratrends.com;) cc: Positive Negative cc: freebsd-questions@freebsd.org cc: Technical Director Subject: RE: Access denied for user 'root'@'localhost' (using password: NO) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Feb 2005 11:46:47 -0000 On Thu, 3 Feb 2005, Ted Mittelstaedt wrote: > Do you run php database driven apps on the same server as you use to > provide shell services? I don't. If the webserver is configured > right it won't allow remote clients to read the scripts, only execute > them. Ted, Shared hosting sites, in my experience anyways which I will grant doesn't mean much, is that your ftp access gives you: -rw-r--r-- {$your_name} {$web_group} somefile.php where {$web_group} is a common group that everyone belongs to and other is always readable just cause it's easier leaving the file/directory mask as is. Meaning that if you can cd to some other users dir you can read that file. As well, in the case of php at least, web use of php does not require the execute bit to be set at all, only the read bit. Again I speak for web use php scripts. Rob. > > -----Original Message----- > > Subject: Re: Access denied for user 'root'@'localhost' (using password: > > NO) > > > > > > > > Positive Negative, > > > > You might seriously consider not using 'root@localhost' as > > well > > I would bet 10 to 1 that he's installing an application that already > is designed NOT to use the mysql root user to access it's database. > This is a case of someone who isn't understanding the design of > the app he's setting up. It worked only because he was running an > out-of-box sql server install which had nothing for a root password. > He probably misread the instructions and used root instead of the > username that he was supposed to use. > > > since most > > php scripts read the username/password information in clear text on a > > nobody:nobody read filesystem. IOW other people can read your files. > > > > Do you run php database driven apps on the same server as you use to > provide shell services? I don't. If the webserver is configured > right it won't allow remote clients to read the scripts, only execute > them. > > Ted >