e894ddb718
The current procedure of setting the root MySQL password leaks the root password by giving it to the setmysqlpass.sh script on the command line. This means that during the couple of seconds that the script is executing, the password is visible in the process list! Since we're already writing the password in the /root/.my.cnf file, make the setmysqlpass.sh script parse this file to retrieve the password instead of receiving it from a command line argument. Also, in some shells the 'echo' command might appear in the process list. Use a heredoc notation to create the output without using a command. Signed-off-by: Gabriel Filion <lelutin@gmail.com>
22 lines
588 B
Bash
22 lines
588 B
Bash
#!/bin/sh
|
|
|
|
test -f /root/.my.cnf || exit 1
|
|
|
|
rootpw=$(grep password /root/.my.cnf | sed -e 's/^[^=]*= *\(.*\) */\1/')
|
|
|
|
/etc/init.d/mysql stop
|
|
|
|
/usr/sbin/mysqld --skip-grant-tables --user=root --datadir=/var/lib/mysql --log-bin=/var/lib/mysql/mysql-bin &
|
|
sleep 5
|
|
mysql -u root mysql <<EOF
|
|
UPDATE mysql.user SET Password=PASSWORD('$rootpw') WHERE User='root' AND Host='localhost';
|
|
FLUSH PRIVILEGES;
|
|
EOF
|
|
killall mysqld
|
|
sleep 15
|
|
# chown to be on the safe side
|
|
ls -al /var/lib/mysql/mysql-bin.* &> /dev/null
|
|
[ $? == 0 ] && chown mysql.mysql /var/lib/mysql/mysql-bin.*
|
|
|
|
/etc/init.d/mysql start
|
|
|