0

this is my first time actually using FreeBSD so there's a chance I might have missed something big, but it's unlikely.

So I want to set up mysql on my pfSense server so I can enable historical logging on ntopng. I am aware of the dangers of doing this and I am taking the necessary precautions to keep my system secure.

I installed it by copying URLs from http://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/ and pasting them into pkg add, which worked. I got mysql56-server and all it's dependencies installed.

Because I'm on pfSense, I have to start it with service mysql-server onestart because there's no rc.conf, but when I do it I get this:

Starting mysql.
Bad -c option
/usr/local/etc/rc.d/mysql-server: WARNING: failed to start mysql

I googled for what bad -c option means for mysql and found zero answers. Not a single page describes a similar issue.

I tried deleting /var/db/mysql/* but it made no difference.

I'm stumped. Thanks in advance.

Edit: yes, there is a mysql user. The pkg automatically made it.

0

Just to get things straight, pfSense doesn't have a mysql package, so you used the official FreeBSD packages instead, by doing

pkg add http://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/mysql80-server-8.0.2_1.txz

This could be the source of the problem.

pfSense 2.3 is based on pkg for the base system and pfSense packages, so the pkg repository from pfSense is used and the standard FreeBSD package repository is not available. Installing packages from FreeBSD is technically possible, but not recommended due to potential dependency problems. Passing the full URL to a package using pkg add will work, but care is needed to avoid future problems.

List of native FreeBSD packages can be found here: http://pkg.freebsd.org/freebsd:10:x86:64/latest/All/

This is from the pfSense documentation.

It could be that the MySQL package has some dependencies on programs/libs for parsing the argument list (which can't be check from here, since you didn't include all the packages you installed) or some programs/libs that are not shipped with pfSense (but are part of FreeBSD).

So you have to check if you have all dependencies installed and this means you have to track down the source of the error.

On a side note, using a Firewall appliance/OS for serving a database is in general not recommended. I'm not implying that this should never be done, but it is an unusual use case.

  • holy crap I'm getting the packages off the freebsd 11 repo but pfsense is freebsd 10. That might be the problem. Testing tomorrow. – LAX1DUDE Mar 5 '18 at 9:12
  • I feel so stupid – LAX1DUDE Mar 5 '18 at 9:12
  • @LAX1DUDE mhh that could be the problem. If you use pfSense 2.3, but 2.4 is based on FreeBSD 11 as far as I know. – Raphael Ahrens Mar 5 '18 at 21:00
  • so I figured out that "Bad -c option." is an sh error (searchcode.com/codesearch/view/458906) which means it's being caused by one of the shell scripts from the service command. I grepped through /etc/rc.subr and found a few (possibly unescaped) sh -c calls, and when I place an echo right before the one on line 1062 I see it in the console. I've been screwing with this line for a while now, changing the quotes, changing the bad nested way of calling sh from su, with no success. Well, at least it's a lead. – LAX1DUDE Mar 11 '18 at 5:53
  • @LAX1DUDE Could you add the line you found to your question? – Raphael Ahrens Mar 11 '18 at 6:11
0

The error is because of some kind of bad escaping method in the freebsd service shell scripts. It tries to su -c 'sh -c "..."' when you specify a specific user to run a service as, and mysql seems to cause problems with this.

I went into /usr/local/etc/rc.d/mysql-server and commented out line 54 mysql_user="mysql" and changed line 55 to mysql_limits_args="-e" and now mysql starts properly because the aforementioned code is not executed.

Do not do this on systems allowing any public connection to the database! If someone finds a remote code execution exploit then you're really screwed because mysql is running as root now, so attackers could read/write to any file on your server! Using it on localhost for ntopng should be safe because no malicious outside connections could get to it, but still, it's not a good idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.