Security-Related mysqld Options and Variables •If you do not trust your DNS, you should use IP addresses rather than host names in the grant tables. In any case, you should be very careful about creating grant table entries using host name values that contain wildcards. •If you want to restrict the number of connections permitted to a single account, you can do so by setting the  max_user_connections  variable in  mysqld . The  CREATE USER  and  ALTER USER  statements also support resource control options for limiting the extent of server use permitted to an account. See Section 13.7.1.3, “CREATE USER Statement” , and Section 13.7.1.1, “ALTER USER Statement” . •If the plugin directory is writable by the server, it may be possible for a user to write executable code to a file in the directory using  SELECT ... INTO DUMPFILE . This can be prevented by making plugin_dir  read only to the server or by setting  secure_file_priv  to a directory where  SELECT writes can be made safely. Table 6.1 Security Option and Variable Summary The following table shows  mysqld  options and system variables that affect security. For descriptions of each of these, see Section 5.1.7, “Server Command Options” , and Section 5.1.8, “Server System Variables” . 6.1.4 Security-Related mysqld Options and Variables 6.1.5 How to Run MySQL as a Normal User 1177 On Windows, you can run the server as a Windows service using a normal user account. On Linux, for installations performed using a MySQL repository or RPM packages, the MySQL server mysqld  should be started by the local  mysql  operating system user. Starting by another operating system user is not supported by the init scripts that are included as part of the MySQL repositories. On Unix (or Linux for installations performed using  tar.gz  packages) , the MySQL server  mysqld  can be started and run by any user. However, you should avoid running the server as the Unix  root  user for security reasons. To change  mysqld  to run as a normal unprivileged Unix user  user_name , you must do the following: Name Cmd-Line Option File System Var Status Var Var Scope Dynamic allow- suspicious- udfs Yes Yes automatic_sp_privileges Yes Yes Yes Global Yes chroot Yes Yes local_infile Yes Yes Yes Global Yes safe-user- create Yes Yes secure_file_priv Yes Yes Yes Global No skip-grant- tables Yes Yes skip_name_resolve Yes Yes Yes Global No skip_networking Yes Yes Yes Global No skip_show_database Yes Yes Yes Global No