mSQL manages security through a file called
msql.acl stored in the mSQL installation
directory. The .acl extension refers to "Access Control
List," a very flexible form of authorization that has been in
use on several operating systems and applications for some time. The
format of the msql.acl file looks like this:
database=mydata
read=*
write=*
host=*
access=local,remote
database=mynewdata
read=*
wriite=admin,root
host=*
access=local
Each database has a stanza of options. The read
and write lines indicate which users you want to
give read (SELECT) or write
(INSERT,UPDATE,DELETE)
access to the database. The host line specifies
which hosts can connect remotely to the database. If the
access line contains "local," local
Unix socket connections are allowed. Similarly, if the
access line contains "remote,"
remote TCP connections are allowed.
database=mynewdata
read=*
write=msql*
host=*.client.com,*isp.com
access=local,remote
Under this ACL, anyone from any host at client.com or anyone from any
host at any domain ending in isp.com -- for example, wisp.com and
lisp.com -- can connect to the database. These users can read from
the database, but only user names beginning with "msql"
can modify the database.
By default, everything is excluded. Thus, if you leave out a
write entry, nobody can modify the database.
Specific users and hosts may be excluded by prefixing their entries
with a "-". Consider the following:
database=moredata
read=-bob,*
write=jane
host=-junk.isp.com,*.isp.com
access=local,remote
This ACL enables all machines from the isp.com domain to connect,
except for junk.isp.com. In addition, everyone except
"bob" can read from the database. Only "jane"
can write to the database. Because rejection is mSQL's default,
having specific rejection entries like "bob," is
meaningless unless the line also contains a wildcard entry.
mSQL acts on the first match it encounters. If, for example, the
wildcard in the read entry came before
"-bob," the wildcard would have matched "bob"
and "bob" would have read access.