MySQL related problems

[toukie]

I have been trying to move a Word Press site to B3. MySQL database is a mess with the "Access denied for user 'root'@'localhost' " messages.

Now I noticed a new message about upgrade:"Failed to access MySQL with default root login, unable to continue with upgrade"

I have not changed the password that is in /etc/mysql/debian.cnf

How do I get back the B3 uppgrade function? The access denied madness goes on even when I use the password from /etc/mysql/debian.cnf

[Eek]

maybe this will help
http://linuxdeal.blogspot.com/2009/06/e ... -user.html

[toukie]

Thx Eek!

The instructions were simple and had the desired effect, now I can see all the databases. The problem is that the default root login for upgrades from Excito is gone: "Failed to access MySQL with default root login, unable to continue with upgrade"

I need the DATABASE for Word Press and the system needs the DATABASE too. How do I make them co-exist? Excito has to have acces to MySQL, now upgrades are gone.

[Ubi]

You are not correct in stating that the system and wordpress need the same database. THey need the same database engine and the same permissions table, but that's all. By default root can login without password which isn't really secure. By clearing out the root password you allow root to login without password and your updates will work again. However, if you expose your wordpress site to the outside world you better not get some sql injection hack .

A potential work-around is by putting the root passwd into .root/.my.cnf, but this only works if the update process loads the environment properly. My guess is that it would work.

[toukie]

"You are not correct in stating that the system and wordpress need the same database."

They both need MySQL anyway.

What I want to learn about is the best practice for security with Word Press, and how to get my updates back. I guess Ubi told me to delete the root password and it should be OK with updates, but then it might start the same "access denied" madness again with MySQL. I was happy to get back the access to MyQSL and went there as root and created a database for Word Press. Maybe it should be on an other user than root? How do I protect the site against those sql injection hacks?

[Eek]

I am sorry, but I do not quite understand you.
don't you use a seperate database and user for wordpress?
have you now succesfully moved the wordpress database?
Maybe this is helpfull? http://www.jebriggs.com/blog/2009/09/re ... rmissions/
basically the only way to guard against sql injection is to keep your wordpress installation current, so you have their latest security fixes.

[Ubi]

yes, and as the installation manual suggests, make a separate user for the wordpress site.

oh and: MySQL is NOT a database!! It is a database management system, that maintains databases. You dimiss this difference too lightly.

[toukie]

Thanks for all advice! I am trying to get into these things as a beginner.

I succeeded in moving the Word Press- site to B3 from another machine where I have it on localhost, created a database and an other user that's not root, but has all the privileges anyway. Now I learn from Eek's link that it doesn't need all of that. That gets to a bit more complicated fine-tuning I guess.

Somehow in the process I busted the updates to B3. It says: "Failed to access MySQL with default root login, unable to continue with upgrade"

Maybe I got the answer to that already from Ubi. I need database and MySQL for Word Press and I need it for the system updates. Now updates don't work, Word Press does. That must be because I created the new root@localhost user for to be able to create the other user. By the way, the password in /etc/mysql/debian.cnf is the same as before. I have two users, one that sees only the Word Press database, the other root@localhost sees all the databases, squeezecenter, horde, album, and mysql plus those that are my own.

What exactly gets the "default root login" back for to enable updates from Excito?

[Ubi]

the default root password is empty.

if you want to change this back (which is not recommended from security, but will ease the updates), first make a copy of your mysql database

Code: Select all

/etc/init.d/mysql stop
tar -czvf /root/mysql-backup.tar.gz /var/lib/mysql/mysql/
/etc/init.d/mysql start

then insert the empty password directly into the table. This is crude, and probably not how it's supposed to be done, but it's effective. These next lines are run directly from command promt, but you can log into mysql first if you like, it does not matter

Code: Select all

mysql mysql -e "select Host,User,Password from user where User = 'root';"
+-----------+------+----------+
| Host      | User | Password |
+-----------+------+----------+
| localhost | root |          |
| b3        | root |          |
| 127.0.0.1 | root |          |
+-----------+------+----------+

This is my setup where there already is no password. For your setup there should be text in the Password column.

Now let's update the password column

Code: Select all

mysql mysql -e "Update user set Password = '' where User = 'root';"
mysql mysql -e "flush privileges;"

[toukie]

thx Ubi, this is great! Learn the hacks first and the basics later!

[toukie]

I didn't have any passwords in that table: "Host User Password", it looked exactly the same as in the example above.

I still have "Failed to access MySQL with default root login, unable to continue with upgrade"

Word Press works fine.

Where does the password in /etc/mysql/debian.cnf come from? It is not one I have created. Should that password be taken away?

[Ubi]

what happens when you just type

Code: Select all

mysql

from the command line?

[toukie]

I get: "ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: NO)" the same goes for the other, non-root user. Su, or no su, makes no difference.

If I use -p I get in with the password. I have two users, "root", and one more that's not root.

[Ubi]

You get in with the OLD password? While you emptied the password from the user table and flushed privileges? That is not possible.

[toukie]

Well, I didn't have any passwords in the table, that's what I said already. If that can't be, then I don't know what to say. I have access to MySQL with two users, but no software updates because of: "Failed to access MySQL with default root login, unable to continue with upgrade"

I am trying again, maybe I never got to the table.The passwords must be there if there are any, I guess.
What does this mean:

ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)

Never mind, I'll get there, I have never been in touch with these things before. It will be easy when I have done it once. Moving Word Press to this server was difficult, but now that I have done it once I see that it wasn't all that complicated.