Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 56471 - phpmyadmin should not assume root user
Summary: phpmyadmin should not assume root user
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: All All
: High enhancement
Assignee: Tom Payne (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-07-08 10:35 UTC by Ryan Roland
Modified: 2004-07-27 08:38 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ryan Roland 2004-07-08 10:35:42 UTC
Our mysql installation doesn't use 'root' as it's DBA.  When one runs the phpmyadmin config: 

ebuild /var/db/pkg/dev-db/phpmyadmin-2.5.6/phpmyadmin-2.5.6.ebuild config

it prompts for the 'root' user password.  Which doesn't exist on our system.  This assumption shouldn't be made.

Prompting for both Username and Password would be preferable.
Comment 1 Martin Holzer (RETIRED) gentoo-dev 2004-07-09 08:01:49 UTC
i vote for WONTFIX

this is from mysql, it has nothing to do with gentoo

  echo ""
  echo "PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL root USER !"
  echo "To do so, start the server, then issue the following commands:"
  echo "/etc/init.d/mysql start (you have to start the server first!)"
  echo "$bindir/mysqladmin -u root -h $hostname password 'new-password'"
  echo "$bindir/mysqladmin -u root password 'new-password'"
  echo "See the manual for more instructions."
Comment 2 Tom Payne (RETIRED) gentoo-dev 2004-07-09 12:22:51 UTC
Ryan,

Initially, I'm inclined to go with mholzer on this one, but I'm open to persuasion. Is there a good reason why you don't use root as your DBA username for MySQL?

That said, a suitable fix would probably to have a variable MYSQL_ROOT that you can set in /etc/make.conf. If unset, it would default to "root". This way people like yourself could override the default value and other users would not see a change.

But before I do this, please tell me why you don't use root as your MySQL username.

Cheers,

Tom
Comment 3 Ryan Roland 2004-07-09 15:34:04 UTC
Firstly, I suppose I must conceded that I work on a relatively small DB server.  We would only ever have about 12 guys who would need complete DBA permissions, therefore user/pass change distribution is quite simple.  However, our environment (university) is unable to be completely restrictive and controlled.  That said, common sense (at least in my warped mind) would seem to say that it's even more difficult for someone to try to breech a system if they have to figure out both a username and its password than to already know that the username is root.  While I'm not saying that this is necessary or even practical for everyone.  It causes problems for those who don't use 'root' to install this ebuild since it fails if you don't have a root user.  

The way I look at it, it is of minimal annoyance to require someone to type 4 letters: 'root' as opposed to having a phpmyadmin install fail due to a username assumption.  

As for the make.conf - MYSQL_ROOT (or MYSQL_DBA or whatever) variable, I appreciate the intent, but I'm not sure that I completely agree with the idea.  Doesn't it break encapsulation (not to mention increase the complexity and overall confusion regarding make.conf) to be putting variables for individual packages into the global portage variable file?   

It returns me to my previous point that I think it is a relatively small matter to handle entering a username (since you're already taking the password) and requiring the user to enter a few more letters.

Please correct any inaccurate assumptions on my part.  And thank you for the opportunity for persuasion.

Ryan
Comment 4 Tom Payne (RETIRED) gentoo-dev 2004-07-27 08:38:38 UTC
The phpmyadmin script now doesn't implement pkg_config. Instead, it prints:

To complete installation, you must

1. Update MySQL's grant tables and the pmadb database:
     mysql -u root -p < ${MY_SQLSCRIPTSDIR}/mysql/${PVR}_create.sql
2. Reload MySQL:
     /etc/init.d/mysql restart

Thus the DBA's username is specified on the command line and is no longer assumed.

Regards,

Tom