Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 306975 - dev-db/mysql-5.1.44: allow root login without password
Summary: dev-db/mysql-5.1.44: allow root login without password
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Infrastructure
Classification: Unclassified
Component: Bugzilla (show other bugs)
Hardware: AMD64 Linux
: High critical (vote)
Assignee: Gentoo Linux MySQL bugs team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-02-26 17:41 UTC by Milosz
Modified: 2011-10-30 23:16 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Milosz 2010-02-26 17:41:41 UTC
After upgrade mysql to 5.1.44 anyone can login into root account without password from console. PhpMyAdmin: #1045 - Access denied for user 'root'@'localhost' (using password: YES)

Reproducible: Always

Steps to Reproduce:
1. upgrade mysql to 5.1.44
Actual Results:  
milosz@oxygen ~ $ mysql -u root -p
Enter password:
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
milosz@oxygen ~ $ mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 5.1.44-log Gentoo Linux mysql-5.1.44

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>
Comment 1 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2010-02-26 23:20:28 UTC
I can't reproduce here.

speedracer ~ # mysql -uroot
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)

Are you sure your configuration was secure before the upgrade?

The instructions at the end of the package note to  run "emerge --config dev-db/mysql", and explicitly require that you set a password.
Comment 2 Milosz 2010-02-26 23:46:19 UTC
I have done:
1. emerge =dev-db/mysql-5.1.44
2. emerge --config =dev-db/mysql-5.1.44
3. I set the password

Next:

oxygen ~ # emerge --config =dev-db/mysql-5.1.44                                                                


Configuring pkg...

 * Creating the mysql database and setting proper
 * permissions on it ...
 * Insert a password for the mysql 'root' user
 * Avoid ["'\_%] characters in the password
    >
 * Retype the password
    >
.100227  0:45:47 [Warning] The syntax '--default-character-set' is deprecated and will be removed in a future release. Please use --character-set-server instead.
100227  0:45:47 [Warning] The syntax '--skip-locking' is deprecated and will be removed in a future release. Please use --skip-external-locking instead.
100227  0:45:47 [Warning] //usr/sbin/mysqld: Option '--set-variable' is deprecated. Use --variable-name=value instead.
....ERROR 2002 (HY000): Can't connect to local MySQL server through socket '//var/run/mysqld/mysqld12373.sock' (2)
 * Loading "zoneinfo", this step may require a few seconds ...
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '//var/run/mysqld/mysqld12373.sock' (2)
/tmp/portage/portage/dev-db/mysql-5.1.44/temp/environment: line 3710: //var/run/mysqld/mysqld11286.pid: Nie ma takiego pliku ani katalogu
kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]
 * Stopping the server ...
 * Done

oxygen ~ # /etc/init.d/mysql start
 * Starting  ...
 * Starting  (/etc/mysql/my.cnf)                                                                         [ ok ]
oxygen ~ #
oxygen ~ # mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.1.44-log Gentoo Linux mysql-5.1.44

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>
Comment 3 Russell Knighton 2010-03-01 23:22:43 UTC
Just to add my 2 pence, this error is in the mysqlerr log file after running emerge --config dev-db/mysql:
[ERROR] /usr/sbin/mysqld: unknown option '--skip-ndbcluster'
[ERROR] Aborting

If I forcefully remove this option (line 1096 in mysql.eclass), it stops again with yet another error:
[ERROR] /usr/sbin/mysqld: unknown option '--skip-bdb'
[ERROR] Aborting

Once I have removed this option too (line 1116 in mysql.eclass), the process appears to complete correctly.

I have these USE flags set on my build:
community perl ssl -big-tables -cluster -debug -embedded -extraengine -latin1 -max-idx-128 -minimal -pbxt -profiling (-selinux) -static -test
Comment 4 Alexandre Rostovtsev (RETIRED) gentoo-dev 2010-03-21 18:59:44 UTC
I can confirm Russel Knighton's observation: with mysql-5.1, "emerge --config dev-db/mysql" does not work because mysqld dies with --skip-ndbcluster and --skip-bdb options; as a result, you have to set the root password, timezones and help tables by hand.
Comment 5 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2010-03-24 02:18:46 UTC
eclass fixed in CVS now.