Bug 21982 - Can not connect to the local MYSQL server when running mysql_secure_installation as root as suggested after installing task-lamp
Summary: Can not connect to the local MYSQL server when running mysql_secure_installat...
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: x86_64 Linux
Priority: Normal major
Target Milestone: ---
Assignee: Marc Krämer
QA Contact:
URL:
Whiteboard:
Keywords: UPSTREAM
: 23151 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-11-05 01:55 CET by Kristoffer Grundström
Modified: 2018-06-08 22:33 CEST (History)
6 users (show)

See Also:
Source RPM: mariadb (?)
CVE:
Status comment:


Attachments
Result of systemctl status mysql and mysqld (3.14 KB, text/plain)
2017-11-05 21:46 CET, Kristoffer Grundström
Details

Description Kristoffer Grundström 2017-11-05 01:55:16 CET
Description of problem: I opened a terminal window. I switched to root and installed task-lamp. No errors during the installation, but as I ran mysql_secure_installation afterwards I got this error:

Enter current password for root (enter for none): 
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2 "No such file or directory")

Version-Release number of selected component (if applicable): 3-6

How reproducible: Error continues to show even after typing in the password several times.

Steps to Reproduce:
1. Open a terminal.
2. Type su - to switch to root.
3. Type urpmi task-lamp.
4. Type mysql_secure_installation just like the output tells you to.
Comment 1 Stig-Ørjan Smelror 2017-11-05 20:42:59 CET
Hi.

Quick question. Are you sure mysql is running?

Haven't run MySQL in a long time and don't know if it is mysql or mysqld.

# systemctl status mysql
or mysqld

If it's not running, start it

# systemctl start mysql
or mysqld

Cheers,
Stig

CC: (none) => smelror

Comment 2 Kristoffer Grundström 2017-11-05 21:46:12 CET
Created attachment 9775 [details]
Result of systemctl status mysql and mysqld
Comment 3 Kristoffer Grundström 2017-11-05 21:47:19 CET
Now when I ran mysql_secure_installation I got this:

Enter current password for root (enter for none): 
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
Comment 4 Kristoffer Grundström 2017-11-05 21:49:33 CET
Just hitting Enter without giving a password seems to do the trick. However I wonder why it wasn't working last night.

Output after hitting Enter:

OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n]
Comment 5 Stig-Ørjan Smelror 2017-11-06 07:23:22 CET
Hi.

Just noticed that the first message says "current password".

- Enter current password for root (enter for none):

Since this was the first installation, there was no current root password. Hitting Enter was the correct action.
If you run the command after successfully completing the setup, you will have to type in the root password you set the first time.

I, too, think this message is a little easy to misunderstand.

Cheers,
Stig
Comment 6 Marja Van Waes 2017-11-09 22:05:01 CET
(In reply to Stig-Ørjan Smelror from comment #5)
> Hi.
> 
> Just noticed that the first message says "current password".
> 
> - Enter current password for root (enter for none):
> 
> Since this was the first installation, there was no current root password.
> Hitting Enter was the correct action.
> If you run the command after successfully completing the setup, you will
> have to type in the root password you set the first time.
> 
> I, too, think this message is a little easy to misunderstand.
> 
> Cheers,
> Stig

This message comes from MariaDB, right? 

What would be a more clear message? It could be useful to ask upstream to change it into that.

Source RPM: task-lamp => mariadb (?)
Keywords: (none) => UPSTREAM
CC: (none) => marja11

Comment 7 Stig-Ørjan Smelror 2017-11-09 23:10:41 CET
(In reply to Marja van Waes from comment #6)
> (In reply to Stig-Ørjan Smelror from comment #5)

<SNIP>

> 
> This message comes from MariaDB, right? 
> 
> What would be a more clear message? It could be useful to ask upstream to
> change it into that.

That's a really good question.

If possible, check to see if this is the first time the script is run and then either omit this question or add a more informational one.

For example: "Since this is the first time you are running this script, hit ENTER"

There are a couple of ways this could be hacked into the script as far as I can see. It would be a giant HACK, but it could also work.

May be better to ask upstream if they can come up with a better solution.

Cheers,
Stig
Comment 8 Bjarne Thomsen 2017-12-26 23:08:46 CET
I am not sure if this is the same problem. I am trying to set the user and password for wordpress, that is wordpres@localhost. I tried (which has worked):
mysql -u root -p
Enter password:
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
Then I created my database by
mysqladmin create kosmologidb
kosmologidb was created.
Then I tried both as user and root:
mysql --user=wordpress --password='xxxxxx' kosmologidb
ERROR 1045 (28000): Access denied for user 'wordpress'@'localhost' (using password: YES)
I am not sure why. Should I use an empty password? and change it later?
I also tried in a browser:
http://localhost/phpmyadmin
I tried to login as root. The same problem: access denied.
Or should I login as wordpress without password?
I have Mageia 6 with latest updates.
mysqld is running.
I am running mysql and wordpress on a Mageia 5 box, and then it was working.
And it is still working with upgrades to Mageia 5 and WordPress.
Any help is appreciated.
Mageia 5 is running out of support, and I am trying to get Mageia 6 running.

--Bjarne

CC: (none) => bjarne.thomsen

Comment 9 Marja Van Waes 2017-12-27 09:09:36 CET
(In reply to Bjarne Thomsen from comment #8)
> I am not sure if this is the same problem. I am trying to set the user and
> password for wordpress, that is wordpres@localhost. I tried (which has
> worked):
> mysql -u root -p
> Enter password:
> ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using
> password: YES)
> Then I created my database by
> mysqladmin create kosmologidb
> kosmologidb was created.
> Then I tried both as user and root:
> mysql --user=wordpress --password='xxxxxx' kosmologidb
> ERROR 1045 (28000): Access denied for user 'wordpress'@'localhost' (using
> password: YES)
> I am not sure why. Should I use an empty password? and change it later?
> I also tried in a browser:
> http://localhost/phpmyadmin
> I tried to login as root. The same problem: access denied.
> Or should I login as wordpress without password?
> I have Mageia 6 with latest updates.
> mysqld is running.
> I am running mysql and wordpress on a Mageia 5 box, and then it was working.
> And it is still working with upgrades to Mageia 5 and WordPress.
> Any help is appreciated.
> Mageia 5 is running out of support, and I am trying to get Mageia 6 running.
> 
> --Bjarne

I don't know, but mokraemer or mjack might know. CC'ing the latter.

@ Marc Krämer

I'm bluntly assigning all of this bug report to you, even if you're not the registered mariadb maintainer, because I hope you'll know better how to handle this report than me.

Feel free to reassign (e.g. to its registered maintainer, to all packagers collectively or back to BugSquad).

Cheers,
Marja

CC: (none) => alien, jackal.j
Assignee: bugsquad => mageia

Comment 10 Bjarne Thomsen 2017-12-27 13:44:47 CET
I have noticed that all services are getting a symbolic owner in order to increase isolation. This is the case for apache, mysql and squid, to mention a few. On Mageia 5 I changed the owner and group for all files in /var/www to apache in order to increase security (including wordpress). This worked fine.
For that reason I did the same thing for a fresh install of Mageia 6 on a similar box. And now I get all these permission denied for root, including for mysql, which should have nothing to do with apache.

From searching the internet for the same error I found an ubuntu user way back in 2011, who was told that mysql required a special user with permission to handle services. What is the policy of Mageia? Should handling services have a special user, or should root be chosen as that user? If so, how is this done?
Comment 11 Bjarne Thomsen 2017-12-27 14:30:59 CET
The mysql problem i probably that root is not in the mysql.user table.
This is not really my problem, but Mageia's problem, if root is going to be used.
Comment 12 Bjarne Thomsen 2017-12-27 15:34:52 CET
Ah-ha. The MySQL root user should be accessed by ssh as root. I found a description for a debian like system (it uses sudo).
I think Mageia must write a short howto to explain how it is done, otherwise it is impossible to create a user for WordPress.
Comment 13 Marc Krämer 2017-12-27 19:50:18 CET
Hi Bjarne,
I'm not quite sure what exactly you are doing.

Did you ever have mysql/mariadb installed before you (re-) installed the latest version in cauldron?

I think you have a few left overs from an earlier installations.

If you don't have /var/lib/mysql and /etc/mysql*, and you install mariadb, via
urpmi mariadb
the start it
systemctl start mysqld
call
mysql_secure_installation
(enter the empty password), you can configure mariadb as you want.

If you have any config or privilieges already installed, the don't get overridden by the new installation. So maybe you disallowed root-access at all.
Comment 14 Bjarne Thomsen 2017-12-27 20:48:06 CET
No. It is a fresh install from a DVD with Mageia 6 followed by updates.
I installed the LAMP metapackage. And I installed mariadb also from the MCC,
but I forgot to mention that I am running a local network on
aopen2.local 192.168.6.1
I now restarted mysqld by systemctl restart mysqld
systemctl status mysqld
tells med that mysqld is running on 192.168.6.1
and there is a GSSAPI plugin error: gss_acquire-cred failed
aopen2.local not found in keytab
I had not paied attention to that error.
Should mysqld be running on localhost? Is this GSSAPI necessary?
I did not know of mysql_secure_installation
Should it be called as root?
I do not like to proceed with a server error.
Is there a way to give the needed credentials to GSSAPI?

Your help is appreciated.

 --Bjarne

https://kosmologi.eu/wordpress
(my Mageia 5 box).
Comment 15 Frank Griffin 2017-12-27 21:20:44 CET
I'm probably telling you something you already know, but just on the off-chance...

mysql has its own private concept of users and passwords, maintained in mysql in a system table, and it has nothing to do with Linux users and passwords.  There is no crossover.

GSSAPI is a red herring.  I think it's an option for authentication and the messages just indicate that it's not in use.

There's a lot about this bug report which goes all over the place.  Could you summarize exactly what you are (currently) trying to do and what error you're getting ?  I don't exactly see what wordpress has to do with it.

CC: (none) => ftg

Comment 16 Bjarne Thomsen 2017-12-27 23:28:26 CET
I am sorry for the confusion. The reason is that I am confused.
I am not in any way an expert on the configuration of mysql, nor do I wish to be one. I just whish to create a mysql database to be used with wordpress, so wordpress is at the core of my problem, however two years ago it was very easy:
$ mysql -u root -p
(enter root password)
mysql> CREATE DATABASE kosmologidb;
Query OK, 1 row affected (0.00 sec)

mysql> GRANT ALL PRIVILEGES ON kosmologidb.* TO "wordpress"@"localhost"
    -> IDENTIFIED BY "xxxxxxxxxxx";
Query OK, 0rows affected (0.00 sec)

mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)

mysql> EXIT
Bye
$
http://localhost/wordpress/
in a browser, takes over from here.

This procedure does not work anymore.
So my question is HOW DO I DO THE SAME THING NOW?

Maybe I should have started another thread, but this one seemed related.

-- Bjarne
Comment 17 Marc Krämer 2017-12-28 01:01:59 CET
Ok, so we mixed up a few things.
On installation of mysql, it was told (as in this thread above):
"NOTE: MariaDB is installed without root password, it is recommended to set the
root password with the following command as soon as possible:

 #  mysql_secure_installation
 press enter at each question except the new root password."[...]

So, the main difference from your old procedure is, mysql has no default password and it is (and should be) different than the linux-root password.

That means, after installation of mysql (mariadb), you should start mysql and call
mysql_secure_installation

Having that done, you can proceed with your known procedure.
Comment 18 Marc Krämer 2017-12-28 01:17:11 CET
@Kristoffer Grundström:
the script (mysql_secure_installation) does not check, if there is already a password set for the (mysql-)root user. The install of our rpm states, we don't set any default password. I don't really see what can be done to solve this.
Comment 19 Frank Griffin 2017-12-28 02:40:00 CET
(In reply to Bjarne Thomsen from comment #16)
> I am sorry for the confusion. The reason is that I am confused.
> This procedure does not work anymore.
> So my question is HOW DO I DO THE SAME THING NOW?

So what errors do you get when you try it now ?
Comment 20 Bjarne Thomsen 2017-12-28 04:44:35 CET
Thank you for clearing up that point. I had forgotten to write down
Enter password:(return)
mysql -u root -p
works as I explained above (I only did it once in December 2015).
I also ran
mysql_secure_installation
and followed the suggested changes except that it should run on localhost, only.
I have explainet that my mysqld is running on aopen2.local (not localhost).
I am not going to shoot myself in the foot.
Anyway, it is much safer than before.

Can mysql_secure_installation be called on my updated Mageia 5 system?

Thank you,

--Bjarne
Comment 21 Marc Krämer 2017-12-28 12:33:03 CET
If you already setup the password for root, it is not necessary to do this again. This has to be done only once.

If your installation is not running locally, you have to connect to the host (via ssh) and run it from this host (so it is localhost again).

If you want to run it remotely, via an open mysql-port, you have to specify the host on commandline:
mysql -h aopen2.local

But the user you want to use to setup a new database must be allowed from external connection and it needs the rights to add a new user / database.

If you already setup this database, I'm quite sure, you have deactivated root access via external connector. And keep in mind the traffic is unencrypted, so it is not very wise to allow remote users to add users/databases or even drop them.
Comment 22 Bjarne Thomsen 2017-12-28 15:39:28 CET
The wordpress recipe that I described was actually created by the wordpress installation running on localhost on the Mageia 5 box. It must have asked me for the root password, and I must have used the root password for the OS. In the meantime I have changed the root password several times. mysql_secure_installation tells me that the root password has been set. This is fine.

The reason for my confusion is that everything is now running on my local network: aopen.local (192.169.5.1)
The trafic is translated to localhost by the caching server squid.
The wordpress recipe tells me to connect to http://localhost/wordpress
in order to configure wordpress, but that URL does not exist.
https://aopen.local/wordpress
does exist, however, on the configured wordpress server.

The question is: How do I configure wordpress on the new aopen2.local server?
I am not sure what I did the first time around.
Maybe I started without a local network.
I realize that this is not a strict mysql question.
I am the only user on the local network.

--Bjarne
Comment 23 Marc Krämer 2017-12-28 15:56:30 CET
Bjarne: If this is not a bug on our installation of mariadb, please visit our forum: https://forums.mageia.org/ , checkout the forum on wordpress or the forum on mariadb.
We need to keep our focus on bugs here, we can't help having trouble with very specific installation issues. This is where users help users in the forum.

Status: NEW => RESOLVED
Resolution: (none) => INVALID

Comment 24 Marja Van Waes 2018-06-08 22:33:23 CEST
*** Bug 23151 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.