1

I am building a set of bash scripts which basically prepare apache virtual hosts, git repositories and other stuff on a cloud server. So far so good, everything is working, but a big problem occurred: MySQL database and users creation.

The current scripts use ssh with keys to authenticate to the cloud server and everyone from my team can execute commands. I want to keep it this way and somehow let them create new MySQL database and user without needing to login to mysql as root or any other user with high privileges, but I don't have any solution for this.

Idea #1 is to create a new mysql user without password and give it full rights (like root) but make it usable only @'localhost'.

Idea #2 is to store the password for this MySQL control user in a file and make it accessible only to the current ssh user which the other scripts use. Then the mysql login will use this stored password to login and create the database and user.

I don't know which option is better and I know they are dangerous. I ask for opinion and any better ideas.

  • dragly.org/2012/03/19/… – Creek May 10 '14 at 16:41
  • As an update to an old question, mysql/mariadb now support unix socket authentication. if connecting via socket and not tcp/ip, the local user name is trusted if it matches the logged in user running the command. – ivanivan Dec 10 '18 at 2:53
0

You want to make the unix user and mysql user that your team use have the least access privileges possible while still allowing them to do what you want. It seems like both your ideas allow more access privileges than necessary. Better for the team mysql user to:

  1. only have CREATE access or just whatever access they need (restricts what your team can do to the minimum). You give a mysql user access using the GRANT statement.
  2. store user/password in ~/my.cnf file with only owner read access (doesn't restrict your team any more, but keeps others from seeing the login if they get to see the script).

The above is easy to do and a big improvement.

A better idea, but more work, would be to not allow the team user access to create databases but just to place a requests to set up sites in some queue, which another user script that only you control (and which only has the access it needs to) would process regularly to set up the sites. The queue could be a file with each line a request, a directory with each file a request or a database table with each record a request. It depends on how much you want to secure your system.

In general you should be using unix and mysql users that don't have as much access as root. I create a working mysql user for myself that can create and delete databases and do only the operations I regularly use. I only use root or a user with similar privileges if I need to set up another user to grant it access privileges. In a script I make the user as restricted as possible to limit the damage if it goes awry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.