Comments (3)
Wouldn't leak the mysql root passwords?
Not more than in the pillar, nor in other place you may need to store it:
- root password is stored in debconf database as well, as seen in #43
- on debian, you can have root privileges with:
mysql --defaults-file=/etc/mysql/debian.cnf mysql
- also by restarting the mysql server without grant tables:
service mysql stop
/usr/bin/mysqld_safe --skip-grant-tables
A person who has root on that box does not necessarily know the MySQL root password:
Drawback, it exposes root password to any root shell users.
A boolean in the pillar will be required to enable this feature.
(pillar suggestion)
mysql:
server:
enable_root_my_cnf: True
Any security suggestion are welcome.
from mysql-formula.
Other way to fetch mysql's root password with shell root access:
for admin knowing the pillar structure can be fetched on the minion:
salt-call config.get mysql:server:root_password
Also, the following confirms that debian-sys-maint
user has all privileges on debian jessie, mariadb 10.0, here is the SQL query for creating this system user:
from: /var/lib/dpkg/info/mariadb-server-10.0.postinst
replace_query=`/bin/echo -e \
"USE mysql;\n" \
"SET sql_mode='';\n" \
"REPLACE INTO user SET " \
" host='localhost', user='debian-sys-maint', password=password('$pass'), " \
" Select_priv='Y', Insert_priv='Y', Update_priv='Y', Delete_priv='Y', " \
" Create_priv='Y', Drop_priv='Y', Reload_priv='Y', Shutdown_priv='Y', " \
" Process_priv='Y', File_priv='Y', Grant_priv='Y', References_priv='Y', " \
" Index_priv='Y', Alter_priv='Y', Super_priv='Y', Show_db_priv='Y', "\
" Create_tmp_table_priv='Y', Lock_tables_priv='Y', Execute_priv='Y', "\
" Repl_slave_priv='Y', Repl_client_priv='Y', Create_view_priv='Y', "\
" Show_view_priv='Y', Create_routine_priv='Y', Alter_routine_priv='Y', "\
" Create_user_priv='Y', Event_priv='Y', Trigger_priv='Y',"\
" ssl_cipher='', x509_issuer='', x509_subject='';"`;
Which can be reseted, simply by:
GRANT ALL ON *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'password from debian.cnf' WITH GRANT OPTION;
from mysql-formula.
Another case where the password is visible, and could be hidden:
salt-call -ldebug state.apply mysql.database
can output
ID: mysql_db_0_load
Function: cmd.wait
Name: mysql -u root -hlocalhost -psomepass foo < /etc/mysql/foo.schema
Result: False
Comment: One or more requisite failed: mysql.database.mysql_db_0_schema
Started:
Duration:
Changes:
from mysql-formula.
Related Issues (20)
- Two databases, two pillar files, one minion HOT 2
- Fix empty values in osfamilymap.yaml
- [BUG] RedHat/CentOS state apply with root password fails HOT 4
- [FEATURE] User access for columns HOT 1
- [BUG] Either don't check for my.cnf rights or remove it if symbolic link HOT 2
- [BUG] GRANT SELECT not working for only 1 user on 2 specific databases. Works on others HOT 4
- Specified SLS 'mysql' in environment 'base' is not available on the salt master
- [BUG] Server is installed when only Client is desired HOT 8
- [BUG] Setting mountpoint breaks tplroot HOT 2
- [BUG] Using mysql:host should not check for package/service
- [BUG] Centos 8 - python client for mysql missing HOT 5
- [BUG] Unable to connect to MySQL using CentOS 8 HOT 2
- Last Update BUG HOT 2
- [FEATURE] Use conf.d folder instead of main cnf file, if available on system
- [BUG] MySQL root password vulnerability and proposed fix HOT 1
- [BUG] root_password not set on debian bullseye HOT 1
- [BUG] mysql.client state does not work out of the box HOT 2
- [FEATURE] Please add support for Jammy HOT 1
- [BUG] Arrays being dumped into config file in invalid form.
- [BUG] inconsistent use of mysql_unix_socket in database.sls and user.sls
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from mysql-formula.