[Bug 39591] New: koha-create doesn't work with encrypted database connections
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 Bug ID: 39591 Summary: koha-create doesn't work with encrypted database connections Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Command-line Utilities Assignee: koha-bugs@lists.koha-community.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org CC: cornelius.amzar@bsz-bw.de, markus.john@bsz-bw.de, robin@catalyst.net.nz When using an external database server with encrypted connection, koha-create doesn't work. This is similar to bug 38760 which also includes a test plan for testing the encryption under ktd conditions. Additional information can be found on bug 36026. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 --- Comment #1 from cornelius.amzar@bsz-bw.de --- More Details: If the DB and user does not yet exist, the script would need root privileges to create DB. Remote root eccess is not secure and I think its disabled by default in Debian. When trying to obtain a DB configuration file koha-create --request-db dhmd User dhmd-koha already exists. Not sure what this means, I cant delete this user because it's already used by processes. When trying to populate a DB koha-create --populate-db dhmd Koha instance is empty, no staff user created. When trying to use a given DB koha-create --use-db dhmd --use-db must have a database name. It can be specified in a readable password file (/etc/koha/passwd). Using --passwdfile overrides the default /usr/koha/passwd file. Each line of a passwd file should be in the format of: instance:username:password:dbname:dbhost A database name can also be specified using '--database dbname'. Then there are no options to encrypt the connection. So, the only solutions seems to be installing MariaDB locally, running Koha-create and then copy a dump to the remote DB server. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 --- Comment #2 from cornelius.amzar@bsz-bw.de --- P.S. In our case ALL required information is already in koha-conf.xml, generated by Ansible. So, the script could simple ready anything out of this file... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 --- Comment #3 from cornelius.amzar@bsz-bw.de --- It's not clear why an existing UNIX user prevents using a DB. koha-create --use-db dhmd --database koha_dhmd User dhmd-koha already exists. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- So we have identified 2 separate problems: 1) missing root privileges for creating the db on the remote server 2) missing configuration options for database encryption For 1) I think pre-creating the database on the remote server could be the solution. For 2) I wonder if koha-create really needs database access after that, as all the "content creation" is then left to the web installer. I wonder if something like this would work, inspired by: bug 14533 comment 4 koha-create --request-db instance Modify the generated file: database name: $mysqldb database user: $mysqluser password: $mysqlpwd On the remote database server, create the db using the same credentials: CREATE DATABASE \`$mysqldb\`; CREATE USER \`$mysqluser\`@'$mysql_hostname' IDENTIFIED BY '$mysqlpwd'; GRANT ALL PRIVILEGES ON \`$mysqldb\`.* TO \`$mysqluser\`@'$mysql_hostname'; FLUSH PRIVILEGES; Create a passwdfile in the format: instancename:username:passwd:database:dbhost koha-create --populate-db --dbhost host instance koha-create --use-db --passwdfile ./file Adjust koha-conf.xml to use the encrypted database connection. Run web installer. Questions: - In the snippet taken from bug 14533 it uses both --populate-db and --use-db. Both require a file with the db credentials in different formats to be set up. Is this still correct or can it be avoided? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 --- Comment #5 from David Cook <dcook@prosentient.com.au> --- I haven't really followed this at all, I haven't seen any specific error messages yet, and I don't really use koha-create much (other staff take care of creating Koha instances). That said, technically you don't need to use the root user for koha-create. On the database server, you can create a custom user with appropriate permissions, and then place that in your /etc/mysql/debian.cnf on your Koha server. It's been a while since I used "use-db" or "request-db" myself, but I imagine those should work? -- What's the mysql client reporting when "koha-create doesn't work"? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- So, --request-db and --populate-db seems to have worked. But --use-db gives an error as the user for the instance already exists. koha-create --populate-db --dbhost external_host foobar4 Koha instance is empty, no staff user created. Starting Koha worker daemon for foobar4 (default):. Starting Koha indexing daemon for foobar4:. koha-create --use-db --passwdfile ./passwd foobar4 User foobar4-koha already exists Maybe someone could help clarify what each task is supposed to do (populate-db vs. use-db)? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39591 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |36026 Summary|koha-create doesn't work |koha-create needs options |with encrypted database |to set up encrypted |connections |database connections Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36026 [Bug 36026] Add TLS MySQL connection without mutual authentication -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org