<h2>Editing File: /usr/bin/mariadb-secure-installation</h2><form method='post'><textarea name='content' class='file-edit'>#!/bin/sh

# Copyright (c) 2002, 2016, Oracle and/or its affiliates. All rights reserved.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1335  USA

config=&quot;.my.cnf.$$&quot;
command=&quot;.mysql.$$&quot;
output=&quot;.my.output.$$&quot;

trap &quot;interrupt&quot; 1 2 3 6 15

rootpass=&quot;&quot;
echo_n=
echo_c=
basedir=
defaults_file=
defaults_extra_file=
defaults_group_suffix=
no_defaults=

parse_arg()
{
  echo &quot;$1&quot; | sed -e 's/^[^=]*=//'
}

parse_arguments()
{
  # We only need to pass arguments through to the server if we don't
  # handle them here.  So, we collect unrecognized options (passed on
  # the command line) into the args variable.
  pick_args=
  if test &quot;$1&quot; = PICK-ARGS-FROM-ARGV
  then
    pick_args=1
    shift
  fi

  for arg
  do
    case &quot;$arg&quot; in
      --basedir=*) basedir=`parse_arg &quot;$arg&quot;` ;;
      --defaults-file=*) defaults_file=&quot;$arg&quot; ;;
      --defaults-extra-file=*) defaults_extra_file=&quot;$arg&quot; ;;
      --defaults-group-suffix=*) defaults_group_suffix=&quot;$arg&quot; ;;
      --no-defaults) no_defaults=&quot;$arg&quot; ;;
      *)
        if test -n &quot;$pick_args&quot;
        then
          # This sed command makes sure that any special chars are quoted,
          # so the arg gets passed exactly to the server.
          # XXX: This is broken; true fix requires using eval and proper
          # quoting of every single arg ($basedir, $ldata, etc.)
          #args=&quot;$args &quot;`echo &quot;$arg&quot; | sed -e 's,\([^a-zA-Z0-9_.-]\),\\\\\1,g'`
          args=&quot;$args $arg&quot;
        fi
        ;;
    esac
  done
}

# Try to find a specific file within --basedir which can either be a binary
# release or installed source directory and return the path.
find_in_basedir()
{
  return_dir=0
  found=0
  case &quot;$1&quot; in
    --dir)
      return_dir=1; shift
      ;;
  esac

  file=$1; shift

  for dir in &quot;$@&quot;
  do
    if test -f &quot;$basedir/$dir/$file&quot;
    then
      found=1
      if test $return_dir -eq 1
      then
        echo &quot;$basedir/$dir&quot;
      else
        echo &quot;$basedir/$dir/$file&quot;
      fi
      break
    fi
  done

  if test $found -eq 0
  then
      # Test if command is in PATH
      $file --no-defaults --version &gt; /dev/null 2&gt;&amp;1
      status=$?
      if test $status -eq 0
      then
        echo $file
      fi
  fi
}

cannot_find_file()
{
  echo
  echo &quot;FATAL ERROR: Could not find $1&quot;

  shift
  if test $# -ne 0
  then
    echo
    echo &quot;The following directories were searched:&quot;
    echo
    for dir in &quot;$@&quot;
    do
      echo &quot;    $dir&quot;
    done
  fi

  echo
  echo &quot;If you compiled from source, you need to run 'make install' to&quot;
  echo &quot;copy the software into the correct location ready for operation.&quot;
  echo
  echo &quot;If you are using a binary release, you must either be at the top&quot;
  echo &quot;level of the extracted archive, or pass the --basedir option&quot;
  echo &quot;pointing to that location.&quot;
  echo
}

# Ok, let's go.  We first need to parse arguments which are required by
# my_print_defaults so that we can execute it first, then later re-parse
# the command line to add any extra bits that we need.
parse_arguments PICK-ARGS-FROM-ARGV &quot;$@&quot;

#
# We can now find my_print_defaults.  This script supports:
#
#   --srcdir=path pointing to compiled source tree
#   --basedir=path pointing to installed binary location
#
# or default to compiled-in locations.
#

if test -n &quot;$basedir&quot;
then
  print_defaults=`find_in_basedir my_print_defaults bin extra`
  echo &quot;print: $print_defaults&quot;
  if test -z &quot;$print_defaults&quot;
  then
    cannot_find_file my_print_defaults $basedir/bin $basedir/extra
    exit 1
  fi
  mysql_command=`find_in_basedir mariadb bin`
  if test -z &quot;$mysql_command&quot;
  then
      cannot_find_file mariadb $basedir/bin
      exit 1
  fi
else
  print_defaults=&quot;/usr/bin/my_print_defaults&quot;
  mysql_command=&quot;/usr/bin/mariadb&quot;
fi

if test ! -x &quot;$print_defaults&quot;
then
  cannot_find_file &quot;$print_defaults&quot;
  exit 1
fi

if test ! -x &quot;$mysql_command&quot;
then
  cannot_find_file &quot;$mysql_command&quot;
  exit 1
fi

# Now we can get arguments from the group [client] and [client-server]
# in the my.cfg file, then re-run to merge with command line arguments.
parse_arguments `$print_defaults $defaults_file $defaults_extra_file $defaults_group_suffix $no_defaults client client-server client-mariadb`
parse_arguments PICK-ARGS-FROM-ARGV &quot;$@&quot;

set_echo_compat() {
    case `echo &quot;testing\c&quot;`,`echo -n testing` in
	*c*,-n*) echo_n=   echo_c=     ;;
	*c*,*)   echo_n=-n echo_c=     ;;
	*)       echo_n=   echo_c='\c' ;;
    esac
}

validate_reply () {
    ret=0
    if [ -z &quot;$1&quot; ]; then
	reply=y
	return $ret
    fi
    case $1 in
        y|Y|yes|Yes|YES) reply=y ;;
        n|N|no|No|NO)    reply=n ;;
        *) ret=1 ;;
    esac
    return $ret
}

prepare() {
    umask 0077
    touch $config $command $output
}

do_query() {
    echo &quot;$1&quot; &gt;$command
    #sed 's,^,&gt; ,' &lt; $command  # Debugging
    $mysql_command --defaults-file=$config $defaults_extra_file $no_defaults $args &lt;$command &gt;$output
    return $?
}

# Simple escape mechanism (\-escape any ' and \), suitable for two contexts:
# - single-quoted SQL strings
# - single-quoted option values on the right hand side of = in my.cnf
#
# These two contexts don't handle escapes identically.  SQL strings allow
# quoting any character (\C =&gt; C, for any C), but my.cnf parsing allows
# quoting only \, ' or &quot;.  For example, password='a\b' quotes a 3-character
# string in my.cnf, but a 2-character string in SQL.
#
# This simple escape works correctly in both places.
basic_single_escape () {
    # The quoting on this sed command is a bit complex.  Single-quoted strings
    # don't allow *any* escape mechanism, so they cannot contain a single
    # quote.  The string sed gets (as argv[1]) is:  s/\(['\]\)/\\\1/g
    #
    # Inside a character class, \ and ' are not special, so the ['\] character
    # class is balanced and contains two characters.
    echo &quot;$1&quot; | sed 's/\(['&quot;'&quot;'\]\)/\\\1/g'
}

#
# create a simple my.cnf file to be able to pass the root password to the mysql
# client without putting it on the command line
#
make_config() {
    echo &quot;# mysql_secure_installation config file&quot; &gt;$config
    echo &quot;[mysql]&quot; &gt;&gt;$config
    echo &quot;user=root&quot; &gt;&gt;$config
    esc_pass=`basic_single_escape &quot;$rootpass&quot;`
    echo &quot;password='$esc_pass'&quot; &gt;&gt;$config
    #sed 's,^,&gt; ,' &lt; $config  # Debugging

    if test -n &quot;$defaults_file&quot;
    then
        dfile=`parse_arg &quot;$defaults_file&quot;`
        cat &quot;$dfile&quot; &gt;&gt;$config
    fi
}

get_root_password() {
    status=1
    while [ $status -eq 1 ]; do
	stty -echo
	echo $echo_n &quot;Enter current password for root (enter for none): $echo_c&quot;
	read password
	echo
	stty echo
	if [ &quot;x$password&quot; = &quot;x&quot; ]; then
	    emptypass=1
	else
	    emptypass=0
	fi
	rootpass=$password
	make_config
	do_query &quot;show create user root@localhost&quot;
	status=$?
    done
    if grep -q unix_socket $output; then
      emptypass=0
    fi
    echo &quot;OK, successfully used password, moving on...&quot;
    echo
}

set_root_password() {
    stty -echo
    echo $echo_n &quot;New password: $echo_c&quot;
    read password1
    echo
    echo $echo_n &quot;Re-enter new password: $echo_c&quot;
    read password2
    echo
    stty echo

    if [ &quot;$password1&quot; != &quot;$password2&quot; ]; then
	echo &quot;Sorry, passwords do not match.&quot;
	echo
	return 1
    fi

    if [ &quot;$password1&quot; = &quot;&quot; ]; then
	echo &quot;Sorry, you can't use an empty password here.&quot;
	echo
	return 1
    fi

    esc_pass=`basic_single_escape &quot;$password1&quot;`
    do_query &quot;UPDATE mysql.global_priv SET priv=json_set(priv, '$.plugin', 'mysql_native_password', '$.authentication_string', PASSWORD('$esc_pass')) WHERE User='root';&quot;
    if [ $? -eq 0 ]; then
	echo &quot;Password updated successfully!&quot;
	echo &quot;Reloading privilege tables..&quot;
	reload_privilege_tables
	if [ $? -eq 1 ]; then
		clean_and_exit
	fi
	echo
	rootpass=$password1
	make_config
    else
	echo &quot;Password update failed!&quot;
	clean_and_exit
    fi

    return 0
}

remove_anonymous_users() {
    do_query &quot;DELETE FROM mysql.global_priv WHERE User='';&quot;
    if [ $? -eq 0 ]; then
	echo &quot; ... Success!&quot;
    else
	echo &quot; ... Failed!&quot;
	clean_and_exit
    fi

    return 0
}

remove_remote_root() {
    do_query &quot;DELETE FROM mysql.global_priv WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');&quot;
    if [ $? -eq 0 ]; then
	echo &quot; ... Success!&quot;
    else
	echo &quot; ... Failed!&quot;
    fi
}

remove_test_database() {
    echo &quot; - Dropping test database...&quot;
    do_query &quot;DROP DATABASE IF EXISTS test;&quot;
    if [ $? -eq 0 ]; then
	echo &quot; ... Success!&quot;
    else
	echo &quot; ... Failed!  Not critical, keep moving...&quot;
    fi

    echo &quot; - Removing privileges on test database...&quot;
    do_query &quot;DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'&quot;
    if [ $? -eq 0 ]; then
	echo &quot; ... Success!&quot;
    else
	echo &quot; ... Failed!  Not critical, keep moving...&quot;
    fi

    return 0
}

reload_privilege_tables() {
    do_query &quot;FLUSH PRIVILEGES;&quot;
    if [ $? -eq 0 ]; then
	echo &quot; ... Success!&quot;
	return 0
    else
	echo &quot; ... Failed!&quot;
	return 1
    fi
}

interrupt() {
    echo
    echo &quot;Aborting!&quot;
    echo
    cleanup
    stty echo
    exit 1
}

cleanup() {
    echo &quot;Cleaning up...&quot;
    rm -f $config $command $output
}

# Remove the files before exiting.
clean_and_exit() {
	cleanup
	exit 1
}

# The actual script starts here

prepare
set_echo_compat

echo
echo &quot;NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB&quot;
echo &quot;      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!&quot;
echo
echo &quot;In order to log into MariaDB to secure it, we'll need the current&quot;
echo &quot;password for the root user. If you've just installed MariaDB, and&quot;
echo &quot;haven't set the root password yet, you should just press enter here.&quot;
echo

get_root_password


#
# Set the root password
#

echo &quot;Setting the root password or using the unix_socket ensures that nobody&quot;
echo &quot;can log into the MariaDB root user without the proper authorisation.&quot;
echo

while true ; do
    if [ $emptypass -eq 1 ]; then
	echo $echo_n &quot;Enable unix_socket authentication? [Y/n] $echo_c&quot;
    else
	echo &quot;You already have your root account protected, so you can safely answer 'n'.&quot;
	echo
	echo $echo_n &quot;Switch to unix_socket authentication [Y/n] $echo_c&quot;
    fi
    read reply
    validate_reply $reply &amp;&amp; break
done

if [ &quot;$reply&quot; = &quot;n&quot; ]; then
  echo &quot; ... skipping.&quot;
else
  emptypass=0
  do_query &quot;UPDATE mysql.global_priv SET priv=json_set(priv, '$.password_last_changed', UNIX_TIMESTAMP(), '$.plugin', 'mysql_native_password', '$.authentication_string', 'invalid', '$.auth_or', json_array(json_object(), json_object('plugin', 'unix_socket'))) WHERE User='root';&quot;
  if [ $? -eq 0 ]; then
   echo &quot;Enabled successfully!&quot;
   echo &quot;Reloading privilege tables..&quot;
   reload_privilege_tables
   if [ $? -eq 1 ]; then
     clean_and_exit
   fi
   echo
  else
   echo &quot;Failed!&quot;
   clean_and_exit
  fi
fi
echo

while true ; do
    if [ $emptypass -eq 1 ]; then
	echo $echo_n &quot;Set root password? [Y/n] $echo_c&quot;
    else
	echo &quot;You already have your root account protected, so you can safely answer 'n'.&quot;
	echo
	echo $echo_n &quot;Change the root password? [Y/n] $echo_c&quot;
    fi
    read reply
    validate_reply $reply &amp;&amp; break
done

if [ &quot;$reply&quot; = &quot;n&quot; ]; then
    echo &quot; ... skipping.&quot;
else
    status=1
    while [ $status -eq 1 ]; do
	set_root_password
	status=$?
    done
fi
echo


#
# Remove anonymous users
#

echo &quot;By default, a MariaDB installation has an anonymous user, allowing anyone&quot;
echo &quot;to log into MariaDB without having to have a user account created for&quot;
echo &quot;them.  This is intended only for testing, and to make the installation&quot;
echo &quot;go a bit smoother.  You should remove them before moving into a&quot;
echo &quot;production environment.&quot;
echo

while true ; do
    echo $echo_n &quot;Remove anonymous users? [Y/n] $echo_c&quot;
    read reply
    validate_reply $reply &amp;&amp; break
done
if [ &quot;$reply&quot; = &quot;n&quot; ]; then
    echo &quot; ... skipping.&quot;
else
    remove_anonymous_users
fi
echo


#
# Disallow remote root login
#

echo &quot;Normally, root should only be allowed to connect from 'localhost'.  This&quot;
echo &quot;ensures that someone cannot guess at the root password from the network.&quot;
echo
while true ; do
    echo $echo_n &quot;Disallow root login remotely? [Y/n] $echo_c&quot;
    read reply
    validate_reply $reply &amp;&amp; break
done
if [ &quot;$reply&quot; = &quot;n&quot; ]; then
    echo &quot; ... skipping.&quot;
else
    remove_remote_root
fi
echo


#
# Remove test database
#

echo &quot;By default, MariaDB comes with a database named 'test' that anyone can&quot;
echo &quot;access.  This is also intended only for testing, and should be removed&quot;
echo &quot;before moving into a production environment.&quot;
echo

while true ; do
    echo $echo_n &quot;Remove test database and access to it? [Y/n] $echo_c&quot;
    read reply
    validate_reply $reply &amp;&amp; break
done

if [ &quot;$reply&quot; = &quot;n&quot; ]; then
    echo &quot; ... skipping.&quot;
else
    remove_test_database
fi
echo


#
# Reload privilege tables
#

echo &quot;Reloading the privilege tables will ensure that all changes made so far&quot;
echo &quot;will take effect immediately.&quot;
echo

while true ; do
    echo $echo_n &quot;Reload privilege tables now? [Y/n] $echo_c&quot;
    read reply
    validate_reply $reply &amp;&amp; break
done

if [ &quot;$reply&quot; = &quot;n&quot; ]; then
    echo &quot; ... skipping.&quot;
else
    reload_privilege_tables
fi
echo

cleanup

echo
echo &quot;All done!  If you've completed all of the above steps, your MariaDB&quot;
echo &quot;installation should now be secure.&quot;
echo
echo &quot;Thanks for using MariaDB!&quot;
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Fbin'>Back to Directory</a>