/* Copyright (c) 2013, 2024, Oracle and/or its affiliates. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License, version 2.0, as published by the Free Software Foundation. This program is designed to work with certain software (including but not limited to OpenSSL) that is licensed under separate terms, as designated in a particular file or component or in included license documentation. The authors of MySQL hereby grant you an additional permission to link the program and your derivative works with the separately licensed software that they have either included with the program or referenced in the documentation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License, version 2.0, for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ #include #include #include #include "client/include/client_priv.h" #include "m_string.h" #ifdef _WIN32 #include "mysql/strings/m_ctype.h" #endif #include "my_alloc.h" #include "my_compiler.h" #include "my_dbug.h" #include "my_default.h" #include "my_inttypes.h" #include "my_macros.h" #include "my_shm_defaults.h" #include "mysql/service_mysql_alloc.h" #include "mysqld_error.h" #include "nulls.h" #include "print_version.h" #include "typelib.h" #include "welcome_copyright_notice.h" // ORACLE_WELCOME_COPYRIGHT_NOTICE using namespace std; static MEM_ROOT argv_alloc{PSI_NOT_INSTRUMENTED, 512}; static char *opt_host = nullptr; static char *opt_user = nullptr; static uint opt_port = 0; static uint opt_protocol = 0; static char *opt_socket = nullptr; static MYSQL mysql_handle; static char *password = nullptr; static bool password_provided = false; static bool g_expire_password_on_exit = false; static bool opt_use_default = false; #if defined(_WIN32) static const char *shared_memory_base_name = default_shared_memory_base_name; #endif #include "client/include/sslopt-vars.h" static const char *load_default_groups[] = {"mysql_secure_installation", "mysql", "client", nullptr}; static struct my_option my_connection_options[] = { {"help", '?', "Display this help and exit.", nullptr, nullptr, nullptr, GET_NO_ARG, NO_ARG, 0, 0, 0, nullptr, 0, nullptr}, {"host", 'h', "Connect to host.", &opt_host, &opt_host, nullptr, GET_STR_ALLOC, REQUIRED_ARG, (longlong) "localhost", 0, 0, nullptr, 0, nullptr}, {"password", 'p', "Password to connect to the server. If password is not " "given it's asked from the tty.", nullptr, nullptr, nullptr, GET_PASSWORD, OPT_ARG, 0, 0, 0, nullptr, 0, nullptr}, #ifdef _WIN32 {"pipe", 'W', "Use named pipes to connect to server.", nullptr, nullptr, nullptr, GET_NO_ARG, NO_ARG, 0, 0, 0, nullptr, 0, nullptr}, #endif {"port", 'P', "Port number to use for connection or 0 for default to, in " "order of preference, my.cnf, $MYSQL_TCP_PORT, " #if MYSQL_PORT_DEFAULT == 0 "/etc/services, " #endif "built-in default (" STRINGIFY_ARG(MYSQL_PORT) ").", &opt_port, &opt_port, nullptr, GET_UINT, REQUIRED_ARG, 0, 0, 0, nullptr, 0, nullptr}, {"protocol", OPT_MYSQL_PROTOCOL, "The protocol to use for connection (tcp, socket, pipe, memory).", nullptr, nullptr, nullptr, GET_STR, REQUIRED_ARG, 0, 0, 0, nullptr, 0, nullptr}, #if defined(_WIN32) {"shared-memory-base-name", OPT_SHARED_MEMORY_BASE_NAME, "Base name of shared memory.", &shared_memory_base_name, &shared_memory_base_name, nullptr, GET_STR_ALLOC, REQUIRED_ARG, 0, 0, 0, nullptr, 0, nullptr}, #endif {"socket", 'S', "Socket file to be used for connection.", &opt_socket, &opt_socket, nullptr, GET_STR_ALLOC, REQUIRED_ARG, 0, 0, 0, nullptr, 0, nullptr}, #include "client/include/sslopt-longopts.h" {"user", 'u', "User for login if not root.", &opt_user, &opt_user, nullptr, GET_STR_ALLOC, REQUIRED_ARG, (longlong) "root", 0, 0, nullptr, 0, nullptr}, {"use-default", 'D', "Execute with no user interactivity", &opt_use_default, &opt_use_default, nullptr, GET_BOOL, NO_ARG, 0, 0, 0, nullptr, 0, nullptr}, /* End token */ {nullptr, 0, nullptr, nullptr, nullptr, nullptr, GET_NO_ARG, NO_ARG, 0, 0, 0, nullptr, 0, nullptr}}; static void usage() { print_version(); fprintf(stdout, ORACLE_WELCOME_COPYRIGHT_NOTICE("2013")); fprintf(stdout, "\nMySQL Configuration Utility."); fprintf(stdout, "Usage: %s [OPTIONS]\n", my_progname); my_print_help(my_connection_options); print_defaults("my", load_default_groups); my_print_variables(my_connection_options); } static void free_resources() { if (opt_host) my_free(opt_host); if (opt_socket) my_free(opt_socket); if (opt_user) my_free(opt_user); if (password) my_free(password); mysql_close(&mysql_handle); } extern "C" { static bool my_arguments_get_one_option(int optid, const struct my_option *opt [[maybe_unused]], char *argument) { switch (optid) { case '?': usage(); free_resources(); exit(0); case 'p': if (argument) { char *start = argument; my_free(password); password = my_strdup(PSI_NOT_INSTRUMENTED, argument, MYF(MY_FAE)); while (*argument) { *argument++ = 'x'; // Destroy argument } if (*start) start[1] = 0; } else password = get_tty_password(NullS); password_provided = true; break; #include "client/include/sslopt-case.h" case OPT_MYSQL_PROTOCOL: opt_protocol = find_type_or_exit(argument, &sql_protocol_typelib, opt->name); break; case 'W': #ifdef _WIN32 opt_protocol = MYSQL_PROTOCOL_PIPE; #endif break; } return false; } } /* Initialize options for the given connection handle. */ static void init_connection_options(MYSQL *mysql) { SSL_SET_OPTIONS(mysql); if (opt_protocol) mysql_options(mysql, MYSQL_OPT_PROTOCOL, (char *)&opt_protocol); #if defined(_WIN32) if (shared_memory_base_name) mysql_options(mysql, MYSQL_SHARED_MEMORY_BASE_NAME, shared_memory_base_name); #endif } /** Reads the response from stdin and returns the first character. If global variable opt_use_default is true then the default_answer is returned instead. @param opt_message Optional message do be displayed. @param default_answer Answer to be given if no interactivity is allowed. @return First character of input string */ static int get_response(const char *opt_message, int default_answer = -1) { int a = 0; int b = 0; int i = 0; if (opt_message) { fprintf(stdout, "%s", opt_message); if (opt_use_default == true && default_answer != -1) { fprintf(stdout, " %c \n", (char)default_answer); return default_answer; } } do { if (i == 1) b = a; a = getchar(); i++; } while (a != '\n'); return b; } /** Takes a mysql query and an optional message as arguments. It displays the message if provided one and then runs the query. If the query is run successfully, the success message is displayed. Else, the failure message along with the actual failure is displayed. If the server is not found running, the program is exited. @param query The mysql query which is to be executed. @param opt_message The optional message to be displayed. */ static void execute_query_with_message(const char *query, const char *opt_message) { if (opt_message) fprintf(stdout, "%s", opt_message); if (!mysql_query(&mysql_handle, query)) fprintf(stdout, "Success.\n\n"); else if ((mysql_errno(&mysql_handle) == ER_PROCACCESS_DENIED_ERROR) || (mysql_errno(&mysql_handle) == ER_TABLEACCESS_DENIED_ERROR) || (mysql_errno(&mysql_handle) == ER_COLUMNACCESS_DENIED_ERROR)) { fprintf(stdout, "The user provided does not have enough permissions " "to continue.\nmysql_secure_installation is exiting.\n"); free_resources(); exit(1); } else fprintf(stdout, " ... Failed! Error: %s\n", mysql_error(&mysql_handle)); if (mysql_errno(&mysql_handle) == CR_SERVER_GONE_ERROR) { free_resources(); exit(1); } } /** Takes a mysql query and the length of the query in bytes as the input. If the query fails on running, a message along with the failure details is displayed. @param query The mysql query which is to be executed. @param length Length of the query in bytes. @return false in case of success true in case of failure */ static bool execute_query(const char **query, size_t length) { if (!mysql_real_query(&mysql_handle, (const char *)*query, (ulong)length)) return false; else if (mysql_errno(&mysql_handle) == CR_SERVER_GONE_ERROR) { fprintf(stdout, " ... Failed! Error: %s\n", mysql_error(&mysql_handle)); free_resources(); exit(1); } if ((mysql_errno(&mysql_handle) == ER_PROCACCESS_DENIED_ERROR) || (mysql_errno(&mysql_handle) == ER_TABLEACCESS_DENIED_ERROR) || (mysql_errno(&mysql_handle) == ER_COLUMNACCESS_DENIED_ERROR)) { fprintf(stdout, "The user provided does not have enough permissions " "to continue.\nmysql_secure_installation is exiting.\n"); free_resources(); exit(1); } return true; } /** Checks if the validate_password component is installed and returns true if it is. */ static bool validate_password_exists() { MYSQL_ROW row; bool res = true; const char *query = "SELECT component_urn FROM mysql.component WHERE component_urn " "= \'file://component_validate_password\'"; if (!execute_query(&query, strlen(query))) DBUG_PRINT("info", ("query success!")); MYSQL_RES *result = mysql_store_result(&mysql_handle); if (!result) return false; row = mysql_fetch_row(result); if (!row) res = false; mysql_free_result(result); return res; } /** Installs validate_password component and sets the password validation policy. @return Returns 1 on successfully setting the component and 0 in case of of any error. */ static int install_password_validation_component() { int reply; int component_set = 0; const char *strength = nullptr; bool option_read = false; reply= get_response((const char *) "\nVALIDATE PASSWORD COMPONENT can be " "used to test passwords\nand improve " "security. It checks the strength of " "password\nand allows the users to set " "only those passwords which are\nsecure " "enough. Would you like to setup VALIDATE " "PASSWORD component?\n\nPress y|Y for Yes," " any other key for No: ", 'y'); if (reply == (int)'y' || reply == (int)'Y') { const char *query_tmp; query_tmp = "INSTALL COMPONENT 'file://component_validate_password'"; if (!execute_query(&query_tmp, strlen(query_tmp))) { component_set = 1; while (!option_read) { reply= get_response((const char *) "\nThere are three levels of " "password validation policy:\n\n" "LOW Length >= 8\n" "MEDIUM Length >= 8, numeric, mixed case, and special characters\n" "STRONG Length >= 8, numeric, mixed case, special characters and dictionary" " file\n\n" "Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: ",'2'); switch (reply) { case (int)'0': strength = "LOW"; option_read = true; break; case (int)'1': strength = "MEDIUM"; option_read = true; break; case (int)'2': strength = "STRONG"; option_read = true; break; default: fprintf(stdout, "\nInvalid option provided.\n"); } } char *query, *end; const int tmp = sizeof("SET GLOBAL validate_password.policy = ") + 3; const size_t strength_length = strlen(strength); /* query string needs memory which is at least the length of initial part of query plus twice the size of variable being appended. */ query = (char *)my_malloc(PSI_NOT_INSTRUMENTED, (strength_length * 2 + tmp) * sizeof(char), MYF(MY_WME)); end = my_stpcpy(query, "SET GLOBAL validate_password.policy = "); *end++ = '\''; end += mysql_real_escape_string_quote(&mysql_handle, end, strength, (ulong)strength_length, '\''); *end++ = '\''; const char *query_const = query; if (!execute_query(&query_const, (unsigned int)(end - query))) DBUG_PRINT("info", ("query success!")); my_free(query); } else fprintf(stdout, "The password validation component is not available. " "Proceeding with the further steps without the component.\n"); } return (component_set); } /** Checks the password strength and displays it to the user. @param password_string Password string whose strength is to be estimated */ static void estimate_password_strength(char *password_string) { char *query, *end; const size_t tmp = sizeof("SELECT validate_password_strength(") + 3; const size_t password_length = strlen(password_string); /* query string needs memory which is at least the length of initial part of query plus twice the size of variable being appended. */ query = (char *)my_malloc(PSI_NOT_INSTRUMENTED, (password_length * 2 + tmp) * sizeof(char), MYF(MY_WME)); end = my_stpcpy(query, "SELECT validate_password_strength("); *end++ = '\''; end += mysql_real_escape_string_quote(&mysql_handle, end, password_string, (ulong)password_length, '\''); *end++ = '\''; *end++ = ')'; const char *query_const = query; if (!execute_query(&query_const, (unsigned int)(end - query))) { MYSQL_RES *result = mysql_store_result(&mysql_handle); MYSQL_ROW row = mysql_fetch_row(result); printf("\nEstimated strength of the password: %s \n", row[0]); mysql_free_result(result); } my_free(query); } /** During rpm deployments the password expires immediately and needs to be renewed before the DBA can set the final password. This helper subroutine will use an active connection to set a password. @param mysql The MYSQL handle @param password A password character string Function might fail with an error message which can be retrieved using mysql_error(mysql) @return Success or failure @retval true success @retval false failure */ static bool mysql_set_password(MYSQL *mysql, char *password) { const size_t password_len = strlen(password); char *query, *end; query = (char *)my_malloc(PSI_NOT_INSTRUMENTED, password_len + 50, MYF(MY_WME)); end = my_stpmov(query, "SET PASSWORD="); *end++ = '\''; end += mysql_real_escape_string_quote(mysql, end, password, (ulong)password_len, '\''); *end++ = '\''; if (mysql_real_query(mysql, query, (ulong)(end - query))) { my_free(query); return false; } my_free(query); return true; } /** Expires the password for all users if executed with sufficient privileges. This is primarily used as a helper function during rpm deployments. @param mysql The MYSQL handle Function might fail with an error message which can be retrieved using mysql_error(mysql) @return Success or failure @retval true success @retval false failure */ static bool mysql_expire_password(MYSQL *mysql) { char sql[] = "UPDATE mysql.user SET password_expired= 'Y'"; const size_t sql_len = strlen(sql); if (mysql_real_query(mysql, sql, (ulong)sql_len)) return false; return true; } /** Sets the user password with the string provided during the flow of the method. It checks for the strength of the password before changing it and displays the same to the user. The user can decide if he wants to continue with the password, or provide a new one, depending on the strength displayed. @param component_set 1 if validate_password component is set and 0 if it is not. */ static void set_opt_user_password(int component_set) { char *password1 = nullptr, *password2 = nullptr; int reply = 0; for (;;) { if (password1) { my_free(password1); password1 = nullptr; } if (password2) { my_free(password2); password2 = nullptr; } password1 = get_tty_password("\nNew password: "); if (password1[0] == '\0') { fprintf(stdout, "Sorry, you can't use an empty password here.\n"); continue; } password2 = get_tty_password("\nRe-enter new password: "); if (strcmp(password1, password2)) { fprintf(stdout, "Sorry, passwords do not match.\n"); continue; } if (component_set == 1) { estimate_password_strength(password1); reply = get_response(( const char *)"Do you wish to continue with the " "password provided?(Press y|Y for " "Yes, any other key for No) : "); } const size_t pass_length = strlen(password1); if ((!component_set) || (reply == (int)'y' || reply == (int)'Y')) { char *query = nullptr, *end; const int tmp = sizeof("SET PASSWORD=") + 3; /* query string needs memory which is at least the length of initial part of query plus twice the size of variable being appended. */ query = (char *)my_malloc(PSI_NOT_INSTRUMENTED, (pass_length * 2 + tmp) * sizeof(char), MYF(MY_WME)); end = my_stpcpy(query, "SET PASSWORD="); *end++ = '\''; end += mysql_real_escape_string_quote(&mysql_handle, end, password1, (ulong)pass_length, '\''); *end++ = '\''; my_free(password1); my_free(password2); password1 = nullptr; password2 = nullptr; const char *query_const = query; if (!execute_query(&query_const, (unsigned int)(end - query))) { my_free(query); break; } else fprintf(stdout, " ... Failed! Error: %s\n", mysql_error(&mysql_handle)); } } } /** Takes the opt_user's password as an input from the user and checks its validity by trying to connect to the server with it. The connection to the server is opened in this function. @return Returns 1 if a password already exists and 0 if it doesn't. */ static int get_opt_user_password() { bool using_temporary_password = false; int res; if (!password_provided) { /* No password is provided on the command line. Attempt to connect using a blank password. */ MYSQL *con = mysql_real_connect(&mysql_handle, opt_host, opt_user, "", "", opt_port, opt_socket, 0); if (con != nullptr || mysql_errno(&mysql_handle) == ER_MUST_CHANGE_PASSWORD_LOGIN) { fprintf(stdout, "Connecting to MySQL using a blank password.\n"); my_free(password); password = nullptr; mysql_close(con); } else { char prompt[128]; snprintf(prompt, sizeof(prompt) - 1, "Enter password for user %s: ", opt_user); // Request password from user password = get_tty_password(prompt); } init_connection_options(&mysql_handle); } // if !password_provided /* A password candidate is identified. Use it to establish a connection. */ if (!mysql_real_connect(&mysql_handle, opt_host, opt_user, password, "", opt_port, opt_socket, 0)) { if (mysql_errno(&mysql_handle) == ER_MUST_CHANGE_PASSWORD_LOGIN) { bool can = true; init_connection_options(&mysql_handle); mysql_options(&mysql_handle, MYSQL_OPT_CAN_HANDLE_EXPIRED_PASSWORDS, &can); if (!mysql_real_connect(&mysql_handle, opt_host, opt_user, password, "", opt_port, opt_socket, 0)) { fprintf(stdout, "Error: %s\n", mysql_error(&mysql_handle)); free_resources(); exit(1); } /* Password worked but has expired. If this happens during a silent deployment using the rpm package system we cannot stop and ask for a password. Instead we just renew the previous password and set it to expire. */ if (using_temporary_password) { if (!mysql_set_password(&mysql_handle, password)) { fprintf(stdout, "... Failed! Error: %s\n", mysql_error(&mysql_handle)); free_resources(); exit(1); } g_expire_password_on_exit = true; } else { /* This path is only executed if no temporary password can be found and should only happen when manual interaction is possible. */ fprintf(stdout, "\nThe existing password for the user account %s has " "expired. Please set a new password.\n", opt_user); set_opt_user_password(0); } } else { fprintf(stdout, "Error: %s\n", mysql_error(&mysql_handle)); free_resources(); exit(1); } } res = (password && password[0] != '\0') ? 1 : 0; return (res); } /** Takes the user and the host from result set and drops those users. @param result The result set from which rows are to be fetched. */ static void drop_users(MYSQL_RES *result) { MYSQL_ROW row; char *user_tmp, *host_tmp; while ((row = mysql_fetch_row(result))) { char *query, *end; size_t user_length, host_length; const int tmp = sizeof("DROP USER ") + 5; user_tmp = row[0]; host_tmp = row[1]; user_length = strlen(user_tmp); host_length = strlen(host_tmp); /* query string needs memory which is at least the length of initial part of query plus twice the size of variable being appended. */ query = (char *)my_malloc( PSI_NOT_INSTRUMENTED, ((user_length + host_length) * 2 + tmp) * sizeof(char), MYF(MY_WME)); end = my_stpcpy(query, "DROP USER "); *end++ = '\''; end += mysql_real_escape_string_quote(&mysql_handle, end, user_tmp, (ulong)user_length, '\''); *end++ = '\''; *end++ = '@'; *end++ = '\''; end += mysql_real_escape_string_quote(&mysql_handle, end, host_tmp, (ulong)host_length, '\''); *end++ = '\''; const char *query_const = query; if (!execute_query(&query_const, (unsigned int)(end - query))) DBUG_PRINT("info", ("query success!")); my_free(query); } } /** Removes all the anonymous users for better security. */ static void remove_anonymous_users() { int reply; reply= get_response((const char *) "By default, a MySQL installation has an " "anonymous user,\nallowing anyone to log " "into MySQL without having to have\na user " "account created for them. This is intended " "only for\ntesting, and to make the " "installation go a bit smoother.\nYou should " "remove them before moving into a production\n" "environment.\n\nRemove anonymous users? " "(Press y|Y for Yes, any other key for No) : ", 'y'); if (reply == (int)'y' || reply == (int)'Y') { const char *query; query = "SELECT USER, HOST FROM mysql.user WHERE USER=''"; if (!execute_query(&query, strlen(query))) DBUG_PRINT("info", ("query success!")); MYSQL_RES *result = mysql_store_result(&mysql_handle); if (result) drop_users(result); mysql_free_result(result); fprintf(stdout, "Success.\n\n"); } else fprintf(stdout, "\n ... skipping.\n\n"); } /** Drops all the root users with a remote host. */ static void remove_remote_root() { int reply; reply= get_response((const char *) "\nNormally, root should only be " "allowed to connect from\n'localhost'. " "This ensures that someone cannot guess at" "\nthe root password from the network.\n\n" "Disallow root login remotely? (Press y|Y " "for Yes, any other key for No) : ", 'y'); if (reply == (int)'y' || reply == (int)'Y') { const char *query; query = "SELECT USER, HOST FROM mysql.user WHERE USER='root' " "AND HOST NOT IN ('localhost', '127.0.0.1', '::1')"; if (!execute_query(&query, strlen(query))) DBUG_PRINT("info", ("query success!")); MYSQL_RES *result = mysql_store_result(&mysql_handle); if (result) drop_users(result); mysql_free_result(result); fprintf(stdout, "Success.\n\n"); } else fprintf(stdout, "\n ... skipping.\n"); } /** Removes test database and deletes the rows corresponding to them from mysql.db table. */ static void remove_test_database() { int reply; reply= get_response((const char *) "By default, MySQL comes with a database " "named 'test' that\nanyone can access. " "This is also intended only for testing,\n" "and should be removed before moving into " "a production\nenvironment.\n\n\nRemove " "test database and access to it? (Press " "y|Y for Yes, any other key for No) : ", 'y'); if (reply == (int)'y' || reply == (int)'Y') { execute_query_with_message((const char *)"DROP DATABASE IF EXISTS test", (const char *)" - Dropping test database...\n"); execute_query_with_message((const char *) "DELETE FROM mysql.db WHERE " "Db='test' OR Db='test\\_%'", (const char *) " - Removing privileges on test " "database...\n"); } else fprintf(stdout, "\n ... skipping.\n"); } /** Refreshes the in-memory details through FLUSH PRIVILEGES. */ static void reload_privilege_tables() { int reply; reply= get_response((const char *) "Reloading the privilege tables will " "ensure that all changes\nmade so far " "will take effect immediately.\n\nReload " "privilege tables now? (Press y|Y for " "Yes, any other key for No) : ", 'y'); if (reply == (int)'y' || reply == (int)'Y') { execute_query_with_message((const char *)"FLUSH PRIVILEGES", nullptr); } else fprintf(stdout, "\n ... skipping.\n"); } int main(int argc, char *argv[]) { int reply; int rc; int hadpass, component_set = 0; MY_INIT(argv[0]); DBUG_TRACE; DBUG_PROCESS(argv[0]); if (mysql_init(&mysql_handle) == nullptr) { printf("... Failed to initialize the MySQL client framework.\n"); exit(1); } #ifdef _WIN32 /* Convert command line parameters from UTF16LE to UTF8MB4. */ my_win_translate_command_line_args(&my_charset_utf8mb4_bin, &argc, &argv); #endif my_getopt_use_args_separator = true; if (load_defaults("my", load_default_groups, &argc, &argv, &argv_alloc)) { my_end(0); free_resources(); exit(1); } my_getopt_use_args_separator = false; if ((rc = my_handle_options(&argc, &argv, my_connection_options, my_arguments_get_one_option, nullptr, true))) { assert(0); } init_connection_options(&mysql_handle); fprintf(stdout, "\nSecuring the MySQL server deployment.\n\n"); hadpass = get_opt_user_password(); if (!validate_password_exists()) component_set = install_password_validation_component(); else { fprintf(stdout, "The 'validate_password' component is installed on the server.\n" "The subsequent steps will run with the existing " "configuration\nof the component.\n"); component_set = 1; } if (!hadpass) { fprintf(stdout, "Please set the password for %s here.\n", opt_user); set_opt_user_password(component_set); } else if (opt_use_default == false) { char prompt[256]; fprintf(stdout, "Using existing password for %s.\n", opt_user); if (component_set == 1) estimate_password_strength(password); snprintf(prompt, sizeof(prompt) - 1, "Change the password for %s ? ((Press y|Y " "for Yes, any other key for No) : ", opt_user); reply = get_response(prompt, 'n'); if (reply == (int)'y' || reply == (int)'Y') set_opt_user_password(component_set); else fprintf(stdout, "\n ... skipping.\n"); } // Remove anonymous users remove_anonymous_users(); // Disallow remote root login remove_remote_root(); // Remove test database remove_test_database(); /* During an unattended rpm deployment a temporary password is created and stored in a file by 'mysqld --initialize'. This program uses this password to perform security configurations after the bootstrap phase, but it needs to be marked for expiration upon exit so the DBA will remember to set a new one. */ if (g_expire_password_on_exit == true) { if (mysql_expire_password(&mysql_handle) == false) { fprintf(stdout, "... Failed to expire password!\n" "** Please consult the MySQL server documentation. **\n" "Error: %s\n", mysql_error(&mysql_handle)); // Reload privilege tables before exiting reload_privilege_tables(); free_resources(); exit(1); } } // Reload privilege tables reload_privilege_tables(); fprintf(stdout, "All done! \n"); free_resources(); return 0; }