MySQLTuner 2.9.1 reports:
SECURITY RISK: Successfully authenticated without password
Environment:
MariaDB 11.8.8
root@localhost
But the root account is configured as:
IDENTIFIED VIA mysql_native_password ... OR unix_socket
So passwordless login works only because MySQLTuner is being run as the Linux root user and MariaDB authenticates via unix_socket.
Confirmed with:
mariadb --no-defaults -uroot -e "SELECT 1;"
which succeeds as Linux root, while:
runuser -u nobody -- mariadb --no-defaults -uroot -e "SELECT 1;"
correctly fails with:
ERROR 1698 (28000): Access denied for user 'root'@'localhost'
It may be better for MySQLTuner to detect unix_socket authentication and avoid reporting this as a security risk.
MySQLTuner 2.9.1 reports:
Environment:
But the root account is configured as:
So passwordless login works only because MySQLTuner is being run as the Linux
rootuser and MariaDB authenticates viaunix_socket.Confirmed with:
mariadb --no-defaults -uroot -e "SELECT 1;"which succeeds as Linux root, while:
runuser -u nobody -- mariadb --no-defaults -uroot -e "SELECT 1;"correctly fails with:
It may be better for MySQLTuner to detect
unix_socketauthentication and avoid reporting this as a security risk.