Security: writing to a file from MySQL CLI I was testing writes to a file from MySQL CLI (locally &amp; remotely) and I wonder what settings are preventing writes for remote users, basically I would like to make sure that it's set on all servers in case someone (devs) will allow remote access to MySQL:

Local (Writes allowed):

mysql&gt; SELECT CURRENT_USER();
+----------------+
| CURRENT_USER() |
+----------------+
| root@localhost |
+----------------+
1 row in set (0.00 sec)

mysql&gt; \P cat &gt;&gt; /etc/passwd
PAGER set to 'cat &gt;&gt; /etc/passwd'
mysql&gt; SELECT CONCAT('test:x:5000:5000::/home/test:/bin/bash');


Remote (writes denied):

mysql&gt; SELECT CURRENT_USER();
+----------------+
| CURRENT_USER() |
+----------------+
| root@%         |
+----------------+
1 row in set (0.01 sec)

mysql&gt; \P cat &gt;&gt; /etc/passwd
PAGER set to 'cat &gt;&gt; /etc/passwd'
mysql&gt; SELECT CONCAT('test:x:5000:5000::/home/test:/bin/bash');
sh: /etc/passwd: Permission denied
I think you are confused about what's happening here.  You ran the client on the server machine as root.  You probably weren't running the client as root on the "remote" machine.  Even if your query had succeeded in appending to /etc/password, you would have only modified your local password file, not the one on the server.

The pager is always local to where the mysql client is running.  It has nothing to do with the MySQL server.  

If the user on the local machine (where the client is running) has write access to a local file, then they can write to the file via the pager option, just as they could write to the file with anything else.  There's nothing here that has anything to do with the MySQL server or permissions.

mysql&gt; \P cat &gt;&gt; foo.bar
PAGER set to 'cat &gt;&gt; foo.bar'
mysql&gt; select NOW();
1 row in set (0.00 sec)

mysql&gt; quit
Bye


Now, by making the file so it can't be written...

sqlbot@dev:~$ chmod 000 foo.bar
sqlbot@dev:~$ mysql

mysql&gt; \P cat &gt;&gt; foo.bar
PAGER set to 'cat &gt;&gt; foo.bar'
mysql&gt; select NOW();
sh: cannot create foo.bar: Permission denied
1 row in set (0.00 sec)

mysql&gt; quit
Bye


Run the client as root on the remote machine and you'll see that you won't get permission denied, but you also will not have modified anything on the server -- just your local password file.

Also, yeah, don't create a 'root'@'%' account in MySQL.