如何在mysql 5.7上进行安全的自动安装?

时间:2018-03-20 16:10:03

标签: mysql

我试图通过使用脚本完全安装mysql 5.7。这引起了一些麻烦,因为我想避免在安装过程中手动响应各种提示。

我已设法自动安装mysql 使用以下代码运行mysql_secure_installation脚本:

# Add MySQL software repo
cd /tmp
curl -OL https://dev.mysql.com/get/mysql-apt-config_0.8.9-1_all.deb
DEBIAN_FRONTEND=noninteractive dpkg -i mysql-apt-config*

# Install mysql
apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y mysql-server

# Clean up install files
rm mysql-apt-config*

# Install "expect"
sudo apt-get -qq install expect > /dev/null

# Generate an expect script
tee ~/secure_mysql.sh > /dev/null << EOF

  spawn $(which mysql_secure_installation)

  # Would you like to setup the validate Password Plugin?
  expect "Press y|Y for Yes, any other key for No:"
  send "n\r"

  # Please set the password for root here.
  expect "New password:"
  send "MyPass\r"

  expect "Re-enter new password:"
  send "MyPass\r"

  # Remove anonymous users
  expect "Remove anonymous users? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  # Disallow remote root login
  expect "Disallow root login remotely? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  # Remove test DB?
  expect "Remove test database and access to it? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  # Reload privilege tables
  expect "Reload privilege tables now? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  expect eof
EOF

# This runs the "mysql_secure_installation" script which removes insecure defaults.
sudo expect ~/secure_mysql.sh

# Cleanup
rm -v ~/secure_mysql.sh

一切看起来都运行正常,但之后我仍然可以在没有密码的情况下以root用户身份登录。我尝试过刷新权限并重新启动mysql但没有帮助。我也试过手动运行mysql_secure_installation,但我遇到了同样的问题(一切看起来好像有效,但我仍然可以没有密码)。

似乎它可能连接到最初安装没有密码的mysql,但我不明白为什么以后会阻止我设置root密码。

还有其他人遇到过这个吗?

1 个答案:

答案 0 :(得分:0)

我设法在我的Ubuntu 16.04系统上运行。无论出于何种原因,安全安装脚本似乎没有设置root密码,如果还没有,那么诀窍是设置密码作为mysql-server安装的一部分使用debconf-set-selections

这还需要更新expect脚本,因为当设置了密码时,提示会略有不同。我的脚本最终如下:

MYSQL_PASS="MyPass"

# Add MySQL software repo (possibly unnecessary for you, but I want to set up group replication later)
cd /tmp
curl -OL https://dev.mysql.com/get/mysql-apt-config_0.8.9-1_all.deb
DEBIAN_FRONTEND=noninteractive dpkg -i mysql-apt-config*

# Install mysql
apt-get update

# You may have to change these two lines
echo "mysql-community-server mysql-community-server/root-pass password $MYSQL_PASS" | debconf-set-selections
echo "mysql-community-server mysql-community-server/re-root-pass password $MYSQL_PASS" | debconf-set-selections

apt-get install -y mysql-server

# Clean up install files
rm mysql-apt-config*

# Install "expect"
apt-get -qq install expect > /dev/null

# Generate an expect script
tee ~/secure_mysql.sh > /dev/null << EOF

  spawn $(which mysql_secure_installation)

  # Enter the password for user root
  expect "Enter the password for user root:"
  send $MYSQL_PASS
  send "\r"

  # Would you like to setup the validate Password Plugin?
  expect "Press y|Y for Yes, any other key for No:"
  send "n\r"

  # Change the password for root?
  expect "Change the password for root ? ((Press y|Y for Yes, any other key for No) :"
  send "n\r"

  # Remove anonymous users
  expect "Remove anonymous users? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  # Disallow remote root login
  expect "Disallow root login remotely? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  # Remove test DB?
  expect "Remove test database and access to it? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  # Reload privilege tables
  expect "Reload privilege tables now? (Press y|Y for Yes, any other key for No) :"
  send "y\r"

  expect eof
EOF

# Run Expect script.
# This runs the "mysql_secure_installation" script which removes insecure defaults.
sudo expect ~/secure_mysql.sh

# Cleanup
rm -v ~/secure_mysql.sh # Remove the generated Expect script

确定正确的debconf-set-selection命令

最简单的方法是设置测试VM并在其上进行mysql的手动试用安装。安装完成后,运行sudo apt install debconf-utils

接下来使用

搜索配置数据库
sudo debconf-get-selections | grep mysql

您正在最后一个字段中查找带密码的选项。对我来说,这些是:

mysql-community-server mysql-community-server/root-pass password
mysql-community-server mysql-community-server/re-root-pass password

但是互联网上有很多不同的命令,所以你的命令可能会有所不同。替换我脚本中的相关部分,你应该(希望)好好去。