[Bug 17237] New: Stop koha-create from creating MySQL users without host restriction
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Bug ID: 17237 Summary: Stop koha-create from creating MySQL users without host restriction Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Packaging Assignee: magnus@libriotech.no Reporter: magnus@libriotech.no QA Contact: testopia@bugs.koha-community.org CC: mirko@abunchofthings.net I am trying to tune MySQL using MySQLTuner (http://mysqltuner.com/). When I run it on my Koha server I get a bunch of warnings like this: [!!] User 'koha_x@%' hasn't specific host restriction. [!!] User 'koha_y@%' hasn't specific host restriction. [!!] User 'koha_z@%' hasn't specific host restriction. And in mysql.user I have: | % | koha_x | | % | koha_y | | % | koha_z | | localhost | koha_x | | localhost | koha_y | | localhost | koha_z | The code that creates these users is in koha-create, line 654 an onwards: # Set up MySQL database for this instance. if [ "$op" = create ] then mysql --defaults-extra-file=/etc/mysql/koha-common.cnf <<eof CREATE DATABASE \`$mysqldb\`; CREATE USER \`$mysqluser\`@'$mysql_hostname' IDENTIFIED BY '$mysqlpwd'; CREATE USER \`$mysqluser\`@'%' IDENTIFIED BY '$mysqlpwd'; GRANT ALL PRIVILEGES ON \`$mysqldb\`.* TO \`$mysqluser\`; FLUSH PRIVILEGES; eof fi #` if [ "$op" = use ] then mysql --defaults-extra-file=/etc/mysql/koha-common.cnf --force <<eof CREATE USER \`$mysqluser\`@'$mysql_hostname' IDENTIFIED BY '$mysqlpwd'; CREATE USER \`$mysqluser\`@'%' IDENTIFIED BY '$mysqlpwd'; GRANT ALL PRIVILEGES ON \`$mysqldb\`.* TO \`$mysqluser\`; FLUSH PRIVILEGES; eof fi #` Perhaps it is just a lack of imagination, but I can't really think of a use for the @% unrestricted user. Am I missing something, or can we just get rid of it? Or if they are needed in some scenarios, can we be more clever about when we create unrestricted users, so they are only created when needed? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 --- Comment #1 from Magnus Enger <magnus@libriotech.no> ---
From IRC:
<eythian> I think it's for when koha-create creates databases on remote servers, perhaps. <eythian> It probably should be off by default but configureable. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=16690 CC| |mtompset@hotmail.com --- Comment #2 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Magnus Enger from comment #1)
From IRC:
<eythian> I think it's for when koha-create creates databases on remote servers, perhaps. <eythian> It probably should be off by default but configureable.
If so, might I suggest looking at bug 16690? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |16690 --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- Bug 16690 will remove the requirement for it from the code. This bug will fix koha-create to not generate the '%'. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16690 [Bug 16690] Remote DB installation fails -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 --- Comment #4 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 74850 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74850&action=edit Bug 17237: Remove CREATE USER 'user'@'%' line Having a 'user'@'%' line decreases database security. Bug 16690 closes the need for such a line, and this bug removes the use of it. TEST PLAN --------- While this depends on 16690, it is not required for testing. On a kohadev box: sudo koha-create --create-db test_17237_a git bz apply 17237 sudo perl ~/misc4dev/cp_debian_files.pl restart_all sudo systemctl daemon-reload sudo koha-create --create_db test_17237_b sudo mysql -u root SELECT user,host from mysql.user; -- test_17237_a will have two entries, one being '%' -- test_17237_b will only have one entry, not '%' -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74850|0 |1 is obsolete| | --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 79372 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79372&action=edit Bug 17237: Remove CREATE USER 'user'@'%' line Having a 'user'@'%' line decreases database security. Bug 16690 closes the need for such a line, and this bug removes the use of it. TEST PLAN --------- While this depends on 16690, it is not required for testing. On a kohadev box: sudo koha-create --create-db test_17237_a git bz apply 17237 sudo perl ~/misc4dev/cp_debian_files.pl restart_all sudo systemctl daemon-reload sudo koha-create --create_db test_17237_b sudo mysql -u root SELECT user,host from mysql.user; -- test_17237_a will have two entries, one being '%' -- test_17237_b will only have one entry, not '%' Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com Status|Needs Signoff |Signed Off --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Does just what it says on the tin when applied with bug 16690, signing off. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79372|0 |1 is obsolete| | --- Comment #7 from Josef Moravec <josef.moravec@gmail.com> --- Created attachment 79848 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=79848&action=edit Bug 17237: Remove CREATE USER 'user'@'%' line Having a 'user'@'%' line decreases database security. Bug 16690 closes the need for such a line, and this bug removes the use of it. TEST PLAN --------- While this depends on 16690, it is not required for testing. On a kohadev box: sudo koha-create --create-db test_17237_a git bz apply 17237 sudo perl ~/misc4dev/cp_debian_files.pl restart_all sudo systemctl daemon-reload sudo koha-create --create_db test_17237_b sudo mysql -u root SELECT user,host from mysql.user; -- test_17237_a will have two entries, one being '%' -- test_17237_b will only have one entry, not '%' Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Josef Moravec <josef.moravec@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |josef.moravec@gmail.com |y.org | CC| |josef.moravec@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com Status|Passed QA |Pushed to Master --- Comment #8 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 18.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #9 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushed to 18.05.x for 18.05.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Bug 17237 depends on bug 16690, which changed state. Bug 16690 Summary: Improve security of remote database installations https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16690 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Stable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Stable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17237 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #10 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.11.x for 17.11.12 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org