1522deafda
Every time the root password reset is used we're leaking the password to the process list. If we use the already present /root/.my.cnf for credentials then it has the same effect for verification and we avoid leaking the password.
26 lines
855 B
Bash
26 lines
855 B
Bash
#!/bin/sh
|
|
|
|
test -f /root/.my.cnf || exit 1
|
|
|
|
rootpw=$(grep password /root/.my.cnf | sed -e 's/^[^=]*= *\(.*\) */\1/')
|
|
|
|
/usr/bin/mysqladmin --defaults-file=/root/.my.cnf status > /dev/null && echo "Nothing to do as the password already works" && exit 0
|
|
|
|
/sbin/service mysqld stop
|
|
|
|
/usr/libexec/mysqld --skip-grant-tables --user=root --datadir=/var/lib/mysql/data --log-bin=/var/lib/mysql/mysql-bin &
|
|
sleep 5
|
|
mysql -u root mysql <<EOF
|
|
UPDATE mysql.user SET Password=PASSWORD('$rootpw') WHERE User='root' AND Host='localhost';
|
|
DELETE FROM mysql.user WHERE (User='root' AND Host!='localhost') OR USER='';
|
|
FLUSH PRIVILEGES;
|
|
EOF
|
|
killall mysqld
|
|
sleep 15
|
|
# chown to be on the safe side
|
|
ls -al /var/lib/mysql/mysql-bin.* &> /dev/null
|
|
[ $? == 0 ] && chown mysql.mysql /var/lib/mysql/mysql-bin.*
|
|
chown -R mysql.mysql /var/lib/mysql/data/
|
|
|
|
/sbin/service mysqld start
|
|
|