Return
-
Title
Anonymous users can connect to the MySQL Server on the TIC server without a password -
Description
Remote hosts can connect to the MySQL Service on the TIC server without a password by entering the following format of information:root@mysql_inst mysql -u -p -3566 -h <ip_address>Why is this allowed and can it be disabled? -
Resolution
No, this feature cannot be disabled. The anonymous user is allowed to log in the TIC server without password, but the account is deliberately granted the limited privileges (only query and execute) on the limited views and store procedures of hub's only, e.g. hub_information_schema.hub_get_version, hub_information_schema.hub_enable_log(). However, for the accounts created in the TIC server, you must input the password when log in.To add, this anonymous user account is required to support certain features that require interacting with TIC without a user context. The biggest example of this is the user self-registration feature: in order to create a new user context, the client must first be able to connect to the server without a user context, since it does not exist yet.The anonymous user is only allowed to connect and call certain carefully controlled stored procedures and query certain metadata views. It cannot access any user data objects, nor create any data objects of its own.