1. Stop the server if it is running (use mysqladmin shutdown ). 

2. Change the database directories and files so that user_name  has privileges to read and write files in them (you might need to do this as the Unix root  user): 

shell> chown -R user_name /path/to/mysql/datadir 

If you do not do this, the server cannot access databases or tables when it runs as user_name . 

If directories or files within the MySQL data directory are symbolic links, chown -R  might not follow symbolic links for you. If it does not, you must also follow those links and change the directories and files they point to. 

3. Start the server as user user_name . Another alternative is to start mysqld  as the Unix root  user and use the --user= user_name  option. mysqld  starts, then switches to run as the Unix user user_name before accepting any connections. 

4. To start the server as the given user automatically at system startup time, specify the user name by adding a user  option to the [mysqld]  group of the /etc/my.cnf  option file or the my.cnf  option file in the server’s data directory. For example: 

[mysqld] user= user_name 

If your Unix machine itself is not secured, you should assign passwords to the MySQL root  account in the grant tables. Otherwise, any user with a login account on that machine can run the mysql  client with a -- user=root  option and perform any operation. (It is a good idea to assign passwords to MySQL accounts in any case, but especially so when other login accounts exist on the server host.) See Section 2.10.4, “Securing the Initial MySQL Account” . 

## 6.1.6 Security Considerations for LOAD DATA LOCAL 

The LOAD DATA  statement loads a data file into a table. The statement can load a file located on the server host, or, if the LOCAL  keyword is specified, on the client host. 

The LOCAL  version of LOAD DATA  has two potential security issues: 

•Because LOAD DATA LOCAL  is an SQL statement, parsing occurs on the server side, and transfer of the file from the client host to the server host is initiated by the MySQL server, which tells the client the file named in the statement. In theory, a patched server could tell the client program to transfer a file of the server’s choosing rather than the file named in the statement. Such a server could access any file on the client host to which the client user has read access. (A patched server could in fact reply with a file-transfer request to any statement, not just LOAD DATA LOCAL , so a more fundamental issue is that clients should not connect to untrusted servers.) 

•In a Web environment where the clients are connecting from a Web server, a user could use LOAD DATA LOCAL  to read any files that the Web server process has read access to (assuming that a user could run any statement against the SQL server). In this environment, the client with respect to the MySQL server actually is the Web server, not a remote program being run by users who connect to the Web server. 

To avoid connecting to untrusted servers, clients can establish a secure connection and verify the server identity by connecting using the --ssl-mode=VERIFY_IDENTITY  option and the appropriate CA certificate. 

To avoid LOAD DATA  issues, clients should avoid using LOCAL  unless proper client-side precautions have been taken. 

