Opened 17 years ago
Last modified 11 years ago
#57 new enhancement
Autoinstallers should read configuration from common files — at Version 1
Reported by: | andersk | Owned by: | |
---|---|---|---|
Priority: | normal | Milestone: | |
Component: | wizard-infra | Keywords: | |
Cc: |
Description (last modified by price)
The autoinstallers should be modified to read the SQL username and password from .my.cnf, and the SQL database name from a configuration file with a common format in the autoinstall directory (so that we can make scripts-remove work, and transfers between accounts easier).
In particular, the status quo of copying the password into the autoinstall means a (now only nearly) silent breach of the SQL database's security in the case where the locker has a couple of ACLs of different sizes -- anyone who can read the autoinstalled software's code can get the password, which the user may not expect.
Change History (1)
comment:1 Changed 16 years ago by price
- Component changed from web to autoinstallers
- Description modified (diff)
Eric writes:
I was shocked today to find out that the scripts autoinstalls don't read the SQL password from ~/.sql/my.cnf, but instead copy the password from there into their own directories without telling the user.
The current state is misleading -- the autoinstaller doesn't ask for the password, and I assumed the autoinstall would do the same thing as the autoinstaller -- and leads to a couple bad consequences:
How hard can it be to change configuration lines from
to
And if fixing it is difficult, could you at least warn the user at install time that you're spewing his SQL password around?
Thanks, Eric