MySQL匿名空用户名处理

问题描述：公司漏扫发现数据库内出现空用户名及密码，需要对这些用户进行整改

1.首先出现了疑问，这些空的用户名是怎么出现的，而且不附带密码。

2.可以手动这样创建这样的用户名和密码形式么。

3.如果能这样创建一个用户，是不是我可以不用用户名和密码能直接登录服务器呢。

4.如何对这样的形式存在进行规避。

空用户名为匿名用户，那么匿名用户能登录么，登录方式可以不用带用户名么。延伸到了mysql的匿名用户，安装完MySQL后，系统默认会创建一个不需要密码的root用户，和一个无用户名无密码的匿名用户(Anonymous Account)。进行下面的初始化操作以合理授权，增强安全。

mysql> create user ''@'localhost' ;
Query OK, 0 rows affected (0.00 sec)

mysql> select user,host,authentication_string from mysql.user;
+------------------+-----------+------------------------------------------------------------------------+
| user             | host      | authentication_string                                                  |
+------------------+-----------+------------------------------------------------------------------------+
| employee_proxy   | %         | *DC6775B6D1F01EFD99CC191E929862480DAC2F7A                              |
| root             | %         | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| test01           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| tspmlf           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| username         | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
|                  | localhost |                                                                        |
| backuper         | localhost | *4DDFC2472B45DA20DB77FD7F3C19996CCCE35897                              |
| employee         | localhost | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9                              |
| mysql.infoschema | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.session    | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.sys        | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| root             | localhost | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| zabbix           | localhost | *C5A9E29672800EE5E1A1B0EA8C397728FD1660D8                              |
+------------------+-----------+------------------------------------------------------------------------+
13 rows in set (0.00 sec)

[mysql@rhel7 ~]$ /usr/local/mysql8/bin/mysql -u -p -hlocalhost -P33306 -S /data/mysql8/db_dxpt08/mysql.sock
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 11
Server version: 8.0.22 MySQL Community Server - GPL

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

--测试证明，采用匿名登录测试可以直接登录数据库，不过登录进来权限受限制

mysql> 

mysql> show grants for ''@'localhost' ;
  +--------------------------------------+
  | Grants for @localhost |
  +--------------------------------------+
  | GRANT USAGE ON *.* TO ``@`localhost` |
  +--------------------------------------+
  1 row in set (0.00 sec)

mysql> select current_user(),user();
+----------------+--------------+
| current_user() | user()       |
+----------------+--------------+
| @localhost     | -p@localhost |
+----------------+--------------+
1 row in set (0.00 sec)

mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
+--------------------+
1 row in set (0.00 sec)

mysql>
mysql>
mysql> select user,host from mysql.user;
ERROR 1142 (42000): SELECT command denied to user ''@'localhost' for table 'user'

如何进行规避，删除这种方式

--用drop ‘’@‘localhost’ 方式进行删除

mysql> select user,host,authentication_string from mysql.user;
+------------------+-----------+------------------------------------------------------------------------+
| user             | host      | authentication_string                                                  |
+------------------+-----------+------------------------------------------------------------------------+
| employee_proxy   | %         | *DC6775B6D1F01EFD99CC191E929862480DAC2F7A                              |
| root             | %         | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| test01           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| tspmlf           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| username         | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
|                  | localhost |                                                                        |
| backuper         | localhost | *4DDFC2472B45DA20DB77FD7F3C19996CCCE35897                              |
| employee         | localhost | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9                              |
| mysql.infoschema | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.session    | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.sys        | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| root             | localhost | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| zabbix           | localhost | *C5A9E29672800EE5E1A1B0EA8C397728FD1660D8                              |
+------------------+-----------+------------------------------------------------------------------------+
13 rows in set (0.00 sec)

mysql> drop user ''@'localhost';
Query OK, 0 rows affected (0.01 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)

mysql> select user,host,authentication_string from mysql.user;
+------------------+-----------+------------------------------------------------------------------------+
| user             | host      | authentication_string                                                  |
+------------------+-----------+------------------------------------------------------------------------+
| employee_proxy   | %         | *DC6775B6D1F01EFD99CC191E929862480DAC2F7A                              |
| root             | %         | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| test01           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| tspmlf           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| username         | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| backuper         | localhost | *4DDFC2472B45DA20DB77FD7F3C19996CCCE35897                              |
| employee         | localhost | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9                              |
| mysql.infoschema | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.session    | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.sys        | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| root             | localhost | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| zabbix           | localhost | *C5A9E29672800EE5E1A1B0EA8C397728FD1660D8                              |
+------------------+-----------+------------------------------------------------------------------------+
12 rows in set (0.00 sec)

--delete from mysql.user where user='';

mysql> create user ''@'127.0.0.1' ;
Query OK, 0 rows affected (0.01 sec)

mysql> select user,host,authentication_string from mysql.user;
+------------------+-----------+------------------------------------------------------------------------+
| user             | host      | authentication_string                                                  |
+------------------+-----------+------------------------------------------------------------------------+
| employee_proxy   | %         | *DC6775B6D1F01EFD99CC191E929862480DAC2F7A                              |
| root             | %         | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| test01           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| tspmlf           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| username         | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
|                  | 127.0.0.1 |                                                                        |
| backuper         | localhost | *4DDFC2472B45DA20DB77FD7F3C19996CCCE35897                              |
| employee         | localhost | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9                              |
| mysql.infoschema | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.session    | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.sys        | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| root             | localhost | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| zabbix           | localhost | *C5A9E29672800EE5E1A1B0EA8C397728FD1660D8                              |
+------------------+-----------+------------------------------------------------------------------------+
13 rows in set (0.00 sec)

mysql> delete from mysql.user where user='';
Query OK, 1 row affected (0.00 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)

mysql> select user,host,authentication_string from mysql.user;
+------------------+-----------+------------------------------------------------------------------------+
| user             | host      | authentication_string                                                  |
+------------------+-----------+------------------------------------------------------------------------+
| employee_proxy   | %         | *DC6775B6D1F01EFD99CC191E929862480DAC2F7A                              |
| root             | %         | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| test01           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| tspmlf           | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| username         | %         | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257                              |
| backuper         | localhost | *4DDFC2472B45DA20DB77FD7F3C19996CCCE35897                              |
| employee         | localhost | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9                              |
| mysql.infoschema | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.session    | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| mysql.sys        | localhost | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| root             | localhost | *858D7135C67CFFAEE40C01A38AB99018DBB245A7                              |
| zabbix           | localhost | *C5A9E29672800EE5E1A1B0EA8C397728FD1660D8                              |
+------------------+-----------+------------------------------------------------------------------------+
12 rows in set (0.00 sec)

匿名用户一般会在刚创建完数据库时，用来防止用户忘记登录密码。如果不及时清理掉，会暴露一个风险给漏扫。