MySQL Bugs: #23698: server inst - don't use mysqladmin in "ctl" script (br 1826)

Bug #23698	server inst - don't use mysqladmin in "ctl" script (br 1826)
Submitted:	26 Oct 2006 23:50	Modified:	13 Nov 2006 22:09
Reporter:	Gary Whizin	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Enterprise Monitor: Installing	Severity:	S2 (Serious)
Version:	0.7.17	OS:	Any (all)
Assigned to:	BitRock Merlin	CPU Architecture:	Any
Tags:	install, password

Description:
The ctl script (mysqlnetworkctl.sh on linux, mysqlnetworkctl.bat on Windows) hardcodes the mysqld database credentials (e.g. root/merlin).

Instead, should this be a commandline parameter passed into the startup script (with a -u -p option to prompt in case none is provided)?

We currently store passwords in the clear here:

- agent .ini file
- configuration.txt (but we warn you to move to secure location)
- server.xml and merlin.xml in the apache-tomcat\conf directory

Should we just document that you should use file system privileges to lock these down and leave it in the shell script?

How to repeat:
install, look at

<install directory>/mysqlnetworkctl.sh

  or

C:\Program Files\<install directory>\mysqlnetworkctl.bat

This is fixed on Windows, but I still see:

MYSQL_STOP="/opt/mysql/network/monitoring/mysql/bin/mysqladmin --socket=/opt/mysql/network/monitoring/mysql/tmp/mysql.sock -u servicemanager -p shutdown"
MYSQL_PASSWORD=""

in mysqlnetworkctl.sh on Linux with the 0.7.28 installer.  From Mark Leith's note, it sounds like those should be removed.

This issue has been fixed in the server and agent installer builds we provided on 11/09.

We look forward to your feedback.

Best regards,

Ivan
BitRock Support

This issue has been fixed in the builds we provided on 11/09.

We look forward to your feedback.

Best regards,

Ivan
BitRock Support

Reported as resolved by Bitrock in ver => 7.29

There are no references to mysqladmin in the mysqlnetworkservice.ctl shell script on linux. Verified in 7.34.