diff options
| author | Gabriel Filion <lelutin@gmail.com> | 2010-12-14 12:10:54 -0500 |
|---|---|---|
| committer | mh <mh@immerda.ch> | 2010-12-18 12:50:17 +0100 |
| commit | e894ddb718fc17f8d541d1b9fcb5ecb2107ade20 (patch) | |
| tree | 8b9d61e95f5dd87c24413af84e1ae7c3d2ac56ea /files | |
| parent | fa6725705679a79abb1e9cc12e2f1b3d803c623f (diff) | |
Avoid root password leak to process list
The current procedure of setting the root MySQL password leaks the root
password by giving it to the setmysqlpass.sh script on the command line.
This means that during the couple of seconds that the script is
executing, the password is visible in the process list!
Since we're already writing the password in the /root/.my.cnf file, make
the setmysqlpass.sh script parse this file to retrieve the password
instead of receiving it from a command line argument.
Also, in some shells the 'echo' command might appear in the process
list. Use a heredoc notation to create the output without using a
command.
Signed-off-by: Gabriel Filion <lelutin@gmail.com>
Diffstat (limited to 'files')
| -rw-r--r-- | files/scripts/CentOS/setmysqlpass.sh | 9 | ||||
| -rw-r--r-- | files/scripts/Debian/setmysqlpass.sh | 9 |
2 files changed, 14 insertions, 4 deletions
diff --git a/files/scripts/CentOS/setmysqlpass.sh b/files/scripts/CentOS/setmysqlpass.sh index d762a20..01d8fbf 100644 --- a/files/scripts/CentOS/setmysqlpass.sh +++ b/files/scripts/CentOS/setmysqlpass.sh @@ -1,12 +1,17 @@ #!/bin/sh -test $# -gt 0 || exit 1 +test -f /root/.my.cnf || exit 1 + +rootpw=$(grep password /root/.my.cnf | sed -e 's/^[^=]*= *\(.*\) */\1/') /sbin/service mysqld stop /usr/libexec/mysqld --skip-grant-tables --user=root --datadir=/var/lib/mysql/data --log-bin=/var/lib/mysql/mysql-bin & sleep 5 -echo "USE mysql; UPDATE user SET Password=PASSWORD('$1') WHERE User='root' AND Host='localhost';" | mysql -u root +mysql -u root mysql <<EOF +UPDATE mysql.user SET Password=PASSWORD('$rootpw') WHERE User='root' AND Host='localhost'; +FLUSH PRIVILEGES; +EOF killall mysqld # chown to be on the safe side chown mysql.mysql /var/lib/mysql/mysql-bin.* diff --git a/files/scripts/Debian/setmysqlpass.sh b/files/scripts/Debian/setmysqlpass.sh index 427daf0..f7d5357 100644 --- a/files/scripts/Debian/setmysqlpass.sh +++ b/files/scripts/Debian/setmysqlpass.sh @@ -1,12 +1,17 @@ #!/bin/sh -test $# -gt 0 || exit 1 +test -f /root/.my.cnf || exit 1 + +rootpw=$(grep password /root/.my.cnf | sed -e 's/^[^=]*= *\(.*\) */\1/') /etc/init.d/mysql stop /usr/sbin/mysqld --skip-grant-tables --user=root --datadir=/var/lib/mysql --log-bin=/var/lib/mysql/mysql-bin & sleep 5 -echo "USE mysql; UPDATE user SET Password=PASSWORD('$1') WHERE User='root' AND Host='localhost';" | mysql -u root +mysql -u root mysql <<EOF +UPDATE mysql.user SET Password=PASSWORD('$rootpw') WHERE User='root' AND Host='localhost'; +FLUSH PRIVILEGES; +EOF killall mysqld sleep 15 # chown to be on the safe side |