Re: how to disable root password reset : mysqld --skip-grant-tables &

[Georgi Kodinov]

--skip-grant-tables basically allows everyone with local access to the disk data used by mysql to start the server and read the data.
This is a widely used mode and kind of non-trivial to prevent without OS specific tricks. If they had access to the disk images how would you prevent one from writing a program that will read the data from the files ? E.g. there's such a program in Ruby nowadays. And since mysql is open source it's not very hard for one to write their own.

So the real thing to protect against is having local access to the disk data.
But 5.0 doesn't offer a lot for that.
In 5.7 we've added tablespace encryption for innodb tables: you can store the key needed to decrypt the data on another computer and control the access to it.
And in 8.0 when you specify --skip-grant-tables it also automatically sets --skip-networking so only local access is possible.

Georgi "Joro" Kodinov
MySQL SrvGen team lead
Plovdiv, Bulgaria