mysql root password needs to be preseeded before any calls to mysqladmin

[gandelman-a]

On Ubuntu (and probably Debian), the mysql root passwd is set during post-installation of the mysql-server package. This needs to be pre-seeded using debconf-set-selections otherwise the initial mysqladmin calls fail during the "set_mysql_rootpw" Exec.

[kbarber]

Other implementations provide a script for breaking in and changing the password:

https://github.com/duritong/puppet-mysql/blob/master/files/scripts/CentOS/setmysqlpass.sh

[jeffmccune]

Is the issue that the mysql module itself should do the pre-seeding?

Or do we simply need to document something in the module for the end user?

I'm having difficulty figuring out if this ticket is actionable or not.

[bodepd]

@jeffmccune: I asked Adam to file this ticket. I have a TODO to sort this out. I am also supposed to merge in debconf features from another mysql module.

[gandelman-a]

I'm not sure pre-seeding the passwd via a debconf module is the best way to fix this. After looking closer at the mysql-server package and how it handles passwd pre-seeding, I noticed mention of Debian bug #513262. I'm going to bring this up to the ubuntu orchestra folks and see if there's a better way. If there is, we might not need to worry about pre-seeding or debconf at all.

I've been using pre-seeding as a workaround for the last week or so, but will remove it and see how easily I can recreate the original issue using whats currently in the master branch.

[kbarber]

So - this is now blocking me for Debian ... woohoo ... :-). So I'm searching for a design decision - I'm happy to fix this whatever we decide if someone else isn't already working on it.

So let re-iterate my previous proposal ... I've used this module in various incarnations in the past - and I've found that the break-in methodology is actually quite good when done correctly.

The method is more or less ... try to connect as root ... if we get a failure ... run a script to 'break in' to the database and change the password. Here is an example implementation of such a script:

https://github.com/duritong/puppet-mysql/blob/master/files/scripts/Debian/setmysqlpass.sh

There is also one for Centos.

So yes - it stops the db, starts it with skip-grant-tables, logs in and changes the password, then restarts normally. Standard MySQL break-in procedure really.

Seems a bit hacky? Well this guarantees you can force puppet to manage the db ... as even existing implementations can be now managed I guess.

So - the other solution sounds like preseeding. I've done a preseed resource in the past to make it easy ... but perhaps something already exists? Otherwise a hack preseed methodology might work - happy to test this theory for its validity.

[gandelman-a]

We spent a good chunk of time looking at this yesterday. On Debian/Ubuntu, you can rely on the debian-sys-maint user having the privileges it needs to reset the root password, and its credentials are generated and stored by package installation at /etc/mysql/debian.cnf . Using this as your defaults file, you can update the the mysql.user table as you wish without shutting down the database or having it up for a long while with skip-grant-tables.

[bodepd]

@kbarber

The proposed fix was merged in commit 9851a43. I just realized how bad the commit message is. Can you verify?

[gandelman-a]

@bodepd Looking at this again, our changes allow database, users, and grants to be created without having to set a root password. For people who may want to set a root password on debian, we can simply use mysql and the debian.cnf defaults file to update the mysql.users table instead of mysqladmin.

[bodepd]

The previous commit has been reverted 9851a43 b/c of complaints about the commit message

[bodepd]

This pull contains the proposed fix for this issue. I would appreciate if someone could look at it before it is merged.

#5

[bodepd]

@gandelman-a - is it ok to open that feature request (should be able to set root password on Debian) as a separate ticket?

[gandelman-a]

@bodepd definitely