AppSuite:DB user privileges - Revision history

Tobias.friedrich: Replaced content with "{{Migration|title=DB-User Privileges|link=https://documentation.open-xchange.com/7.10.2/middleware/administration/db_user_privileges.html}}"

2019-04-26T10:40:17Z

Replaced content with "{{Migration|title=DB-User Privileges|link=https://documentation.open-xchange.com/7.10.2/middleware/administration/db_user_privileges.html}}"

← Older revision		Revision as of 10:40, 26 April 2019
Line 1:		Line 1:
	{{~~VersionFrom~~\|~~7.8.0}}~~		{{Migration\|title=DB-User Privileges\|link=https://documentation.open-xchange.com/7.10.2/middleware/administration/db_user_privileges.html}}

	~~<div class="~~title~~">How to reduce Open-Xchange database user privileges for existing installations</div>~~

	'''Summary''': This article tells you how to reduce the database user privileges in existing Open-Xchange installations to those at least required ones. Changing the existing <code>ALL PRIVILEDGES</code> to the provided minimum set will have no implications for running the server.

	The minimum required set of privileges is: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, EXECUTE and SHOW DATABASES.

	~~Starting with v7.8.0 the following privileges are required: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW and SHOW DATABASES.~~

	~~__TOC__~~

	~~== Change of existing privileges =~~=
	~~1. Login to master mysql database using root user.~~

	~~2. Detect the existing Open-Xchange users: <code><pre>SELECT USER,HOST FROM mysql.user;</pre></code>~~

	~~The output will look like outlined in the following table:~~

	~~<code><pre>~~
	~~+------------------+----------~~-+
	\| ~~user \| host \|~~
	~~+------------------+-----------+~~
	~~\| openexchange \| % \|~~
	~~\| root \| 127.0.0.1 \|~~
	~~</pre></code>~~

	~~In this case the user for all additional processings is 'openexchange'@'%' and will be used for the description below.~~

	~~3. Detect all existing privileges for the Open-Xchange user above~~: ~~<code><pre>SHOW GRANTS FOR 'openexchange'@'%';<~~/~~pre><~~/~~code>~~

	~~The output will look like outlined in the following table. If the output is extremly different the user already has got limited privileges~~.

	~~<code><pre>~~
	~~+----~~-~~----------------------------------------------------------------------------------------------+~~
	~~\| Grants for openexchange@% \|~~
	~~+---------------------------------------------------------------------------------------------------+~~
	~~\| GRANT ALL PRIVILEGES ON . TO 'openexchange'@'%' IDENTIFIED BY PASSWORD~~
	~~'*ef14c45205444fdd47b6c1d88b74e1345fd0c394' \|~~
	~~+---------------------------------------------------------------------------------------------------+~~
	~~1 row in set (0,00 sec)~~
	~~</pre></code>~~

	4. Revoke all existing privileges for the Open-Xchange user above. Be careful to use the database@host pattern provided by the output from #3 (in this case .): <code><pre>REVOKE ALL PRIVILEGES ON . FROM 'openexchange'@'%';</pre></code>

	~~Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.~~

	5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></~~code>~~


	~~6. Write the privileges: <code><pre>FLUSH PRIVILEGES;</pre></code>~~

	7. ~~The changes of the privileges are noticed by the server so that the grant tables are loaded into memory again immediately after the change~~. ~~You do not have to restart mysql.~~

	~~The grants outlined by <code><pre>SHOW GRANTS FOR 'openexchange'@'%';<~~/~~pre><~~/~~code> should now look like (grants for configdb, schema, global db, guard db and guard shard available):~~

	~~<code><pre>~~
	~~+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+~~
	\| Grants for openexchange@% \|
	~~+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+~~
	\| GRANT USAGE ON . TO 'openexchange'@'%' IDENTIFIED BY PASSWORD '*ef14c45205444fdd47b6c1d88b74e1345fd0c394' \|
	~~\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `configdb`.* TO 'openexchange'@'%' WITH GRANT OPTION \|~~
	~~\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxdatabase_6`.* TO 'openexchange'@'%' WITH GRANT OPTION \|~~
	~~\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxdatabase_global`.* TO 'openexchange'@'%' WITH GRANT OPTION \|~~
	~~\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxguard1`.* TO 'openexchange'@'%' WITH GRANT OPTION \|~~
	~~\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxguard`.* TO 'openexchange'@'%' WITH GRANT OPTION \|~~
	~~+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+~~
	</~~pre></code>~~

	8. ~~Execute~~

	~~[[Category: OX7]]~~
	~~[[Category: AppSuite]]~~
	~~[[Category: Administrator]]~~
	~~[[Category: Database]]~~
	~~[[Category: Security]]~~

Martin.schneider at 07:32, 29 September 2015

2015-09-29T07:32:54Z

← Older revision		Revision as of 07:32, 29 September 2015
Line 59:		Line 59:
	\| Grants for openexchange@% \|		\| Grants for openexchange@% \|
	+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+		+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
	\| GRANT USAGE ON . TO 'openexchange'@'%' IDENTIFIED BY PASSWORD '*~~14E65567ABDB5135D0CFD9A70B3032C179A49EE7~~' \|		\| GRANT USAGE ON . TO 'openexchange'@'%' IDENTIFIED BY PASSWORD '*ef14c45205444fdd47b6c1d88b74e1345fd0c394' \|
	\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `configdb`.* TO 'openexchange'@'%' WITH GRANT OPTION \|		\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `configdb`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
	\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxdatabase_6`.* TO 'openexchange'@'%' WITH GRANT OPTION \|		\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxdatabase_6`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
Line 66:		Line 66:
	\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxguard`.* TO 'openexchange'@'%' WITH GRANT OPTION \|		\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxguard`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
	+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+		+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

	</pre></code>		</pre></code>

Martin.schneider at 07:32, 29 September 2015

2015-09-29T07:32:10Z

← Older revision		Revision as of 07:32, 29 September 2015
Line 52:		Line 52:

	7. The changes of the privileges are noticed by the server so that the grant tables are loaded into memory again immediately after the change. You do not have to restart mysql.		7. The changes of the privileges are noticed by the server so that the grant tables are loaded into memory again immediately after the change. You do not have to restart mysql.

			The grants outlined by <code><pre>SHOW GRANTS FOR 'openexchange'@'%';</pre></code> should now look like (grants for configdb, schema, global db, guard db and guard shard available):

			<code><pre>
			+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
			\| Grants for openexchange@% \|
			+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
			\| GRANT USAGE ON . TO 'openexchange'@'%' IDENTIFIED BY PASSWORD '*14E65567ABDB5135D0CFD9A70B3032C179A49EE7' \|
			\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `configdb`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
			\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxdatabase_6`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
			\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxdatabase_global`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
			\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxguard1`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
			\| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, SHOW VIEW ON `oxguard`.* TO 'openexchange'@'%' WITH GRANT OPTION \|
			+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

			</pre></code>

	8. Execute		8. Execute

Lars.hoogestraat at 08:09, 14 September 2015

2015-09-14T08:09:45Z

← Older revision		Revision as of 08:09, 14 September 2015
Line 46:		Line 46:
	Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.		Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.

	5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES, EXECUTE ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>		5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>

	~~Since 7.8.0 (preliminary) the following reduced privileges are mandatory~~: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>

Lars.hoogestraat: Reduced permission set with 7.8.0

2015-08-26T07:59:06Z

Reduced permission set with 7.8.0

← Older revision		Revision as of 07:59, 26 August 2015
Line 47:		Line 47:

	5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES, EXECUTE ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>		5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES, EXECUTE ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>

			Since 7.8.0 (preliminary) the following reduced privileges are mandatory: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>


	6. Write the privileges: <code><pre>FLUSH PRIVILEGES;</pre></code>		6. Write the privileges: <code><pre>FLUSH PRIVILEGES;</pre></code>

Khgras at 08:09, 22 July 2015

2015-07-22T08:09:22Z

← Older revision		Revision as of 08:09, 22 July 2015
Line 1:		Line 1:
			{{VersionFrom\|7.8.0}}

	<div class="title">How to reduce Open-Xchange database user privileges for existing installations</div>		<div class="title">How to reduce Open-Xchange database user privileges for existing installations</div>

Lars.hoogestraat: Described reduced privileges with 7.80

2015-05-18T12:07:23Z

Described reduced privileges with 7.80

← Older revision		Revision as of 12:07, 18 May 2015
Line 4:		Line 4:

	The minimum required set of privileges is: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, EXECUTE and SHOW DATABASES.		The minimum required set of privileges is: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, EXECUTE and SHOW DATABASES.

			Starting with v7.8.0 the following privileges are required: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW and SHOW DATABASES.

	__TOC__		__TOC__

Jan.bauerdick: Added EXECUTE to privilege set

2015-04-24T08:32:27Z

Added EXECUTE to privilege set

← Older revision		Revision as of 08:32, 24 April 2015
Line 3:		Line 3:
	'''Summary''': This article tells you how to reduce the database user privileges in existing Open-Xchange installations to those at least required ones. Changing the existing <code>ALL PRIVILEDGES</code> to the provided minimum set will have no implications for running the server.		'''Summary''': This article tells you how to reduce the database user privileges in existing Open-Xchange installations to those at least required ones. Changing the existing <code>ALL PRIVILEDGES</code> to the provided minimum set will have no implications for running the server.

	The minimum required set of privileges is: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE and SHOW DATABASES.		The minimum required set of privileges is: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, EXECUTE and SHOW DATABASES.

	__TOC__		__TOC__
Line 42:		Line 42:
	Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.		Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.

	5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>		5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES, EXECUTE ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>

	6. Write the privileges: <code><pre>FLUSH PRIVILEGES;</pre></code>		6. Write the privileges: <code><pre>FLUSH PRIVILEGES;</pre></code>

Khgras at 08:30, 24 April 2015

2015-04-24T08:30:08Z

← Older revision	Revision as of 08:30, 24 April 2015
Line 1:	Line 1:
		<div class="title">How to reduce Open-Xchange database user privileges for existing installations</div>

		'''Summary''': This article tells you how to reduce the database user privileges in existing Open-Xchange installations to those at least required ones. Changing the existing <code>ALL PRIVILEDGES</code> to the provided minimum set will have no implications for running the server.

		The minimum required set of privileges is: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE and SHOW DATABASES.

		__TOC__

		== Change of existing privileges ==
		1. Login to master mysql database using root user.

		2. Detect the existing Open-Xchange users: <code><pre>SELECT USER,HOST FROM mysql.user;</pre></code>

		The output will look like outlined in the following table:

		<code><pre>
		+------------------+-----------+
		\| user \| host \|
		+------------------+-----------+
		\| openexchange \| % \|
		\| root \| 127.0.0.1 \|
		</pre></code>

		In this case the user for all additional processings is 'openexchange'@'%' and will be used for the description below.

		3. Detect all existing privileges for the Open-Xchange user above: <code><pre>SHOW GRANTS FOR 'openexchange'@'%';</pre></code>

		The output will look like outlined in the following table. If the output is extremly different the user already has got limited privileges.

		<code><pre>
		+---------------------------------------------------------------------------------------------------+
		\| Grants for openexchange@% \|
		+---------------------------------------------------------------------------------------------------+
		\| GRANT ALL PRIVILEGES ON . TO 'openexchange'@'%' IDENTIFIED BY PASSWORD
		'*ef14c45205444fdd47b6c1d88b74e1345fd0c394' \|
		+---------------------------------------------------------------------------------------------------+
		1 row in set (0,00 sec)
		</pre></code>

		4. Revoke all existing privileges for the Open-Xchange user above. Be careful to use the database@host pattern provided by the output from #3 (in this case .): <code><pre>REVOKE ALL PRIVILEGES ON . FROM 'openexchange'@'%';</pre></code>

		Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.

		5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>

		6. Write the privileges: <code><pre>FLUSH PRIVILEGES;</pre></code>

		7. The changes of the privileges are noticed by the server so that the grant tables are loaded into memory again immediately after the change. You do not have to restart mysql.

		8. Execute

		[[Category: OX7]]
		[[Category: AppSuite]]
		[[Category: Administrator]]
		[[Category: Database]]
		[[Category: Security]]

Khgras: Blanked the page

2014-10-07T10:24:37Z

Blanked the page

← Older revision		Revision as of 10:24, 7 October 2014
Line 1:		Line 1:
	~~<div class="title">How to reduce Open-Xchange database user privileges for existing installations</div>~~

	'''Summary''': This article tells you how to reduce the database user privileges in existing Open-Xchange installations to those at least required ones. Changing the existing <code>ALL PRIVILEDGES</code> to the provided minimum set will have no implications for running the server.

	The minimum required set of privileges is: CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE and SHOW DATABASES.

	~~__TOC__~~

	~~== Change of existing privileges ==~~
	~~1. Login to master mysql database using root user.~~

	~~2. Detect the existing Open-Xchange users: <code><pre>SELECT USER,HOST FROM mysql.user;</pre></code>~~

	~~The output will look like outlined in the following table:~~

	~~<code><pre>~~
	~~+------------------+-----------+~~
	~~\| user \| host \|~~
	~~+------------------+-----------+~~
	~~\| openexchange \| % \|~~
	~~\| root \| 127.0.0.1 \|~~
	~~</pre></code>~~

	~~In this case the user for all additional processings is 'openexchange'@'%' and will be used for the description below.~~

	~~3. Detect all existing privileges for the Open-Xchange user above: <code><pre>SHOW GRANTS FOR 'openexchange'@'%';</pre></code>~~

	~~The output will look like outlined in the following table. If the output is extremly different the user already has got limited privileges.~~

	~~<code><pre>~~
	~~+---------------------------------------------------------------------------------------------------+~~
	~~\| Grants for openexchange@% \|~~
	~~+---------------------------------------------------------------------------------------------------+~~
	~~\| GRANT ALL PRIVILEGES ON . TO 'openexchange'@'%' IDENTIFIED BY PASSWORD~~
	~~'*ef14c45205444fdd47b6c1d88b74e1345fd0c394' \|~~
	~~+---------------------------------------------------------------------------------------------------+~~
	~~1 row in set (0,00 sec)~~
	~~</pre></code>~~

	4. Revoke all existing privileges for the Open-Xchange user above. Be careful to use the database@host pattern provided by the output from #3 (in this case .): <code><pre>REVOKE ALL PRIVILEGES ON . FROM 'openexchange'@'%';</pre></code>

	~~Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.~~

	5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>

	~~6. Write the privileges: <code><pre>FLUSH PRIVILEGES;</pre></code>~~

	~~7. The changes of the privileges are noticed by the server so that the grant tables are loaded into memory again immediately after the change. You do not have to restart mysql.~~

	~~[[Category: OX7]]~~
	~~[[Category: AppSuite]]~~
	~~[[Category: Administrator]]~~
	~~[[Category: Database]]~~
	~~[[Category: Security]]~~

← Older revision		Revision as of 08:09, 14 September 2015
Line 46:		Line 46:
	Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.		Hint: This must be executed for each database@hostname combination displayed in #3 (normally just .). Without revoking privileges you will have duplicates.

	5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, ALTER ROUTINE, CREATE ROUTINE, SHOW DATABASES, EXECUTE ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>		5. Create new privileges: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>

	~~Since 7.8.0 (preliminary) the following reduced privileges are mandatory~~: <code><pre>GRANT CREATE, LOCK TABLES, REFERENCES, INDEX, DROP, DELETE, ALTER, SELECT, UPDATE, INSERT, CREATE TEMPORARY TABLES, SHOW VIEW, SHOW DATABASES ON . TO 'openexchange'@'%' IDENTIFIED BY '<YOUR_DB_PASS>' WITH GRANT OPTION;</pre></code>