Virtualmin creates MySQL password incorrectly

Submitted by ghomem on Thu, 06/28/2012 - 17:33

Hi,

Sorry to bother.

After a virtual host creation where a MySQL login is created I realized that the corresponding MySQL user has a (hashed) password stored which is not correct, ie, does not match the domain password which is correctly set.

That is:

mysql --user MYUSER -p

doesn't accept the password until we force the change via MySQL webmin module.

I verified that the hash changes from post user creation to post password change enforcement via MySQL webmin.

It would seem that the code for password changing on the MySQL webmin module is correct whereas what is used in Virtualmin might have a problem.

Failure confirmed with Virtualmin GPL 3.92.gpl on Centos6.

However it works with Virtualmin Pro 3.69 on Centos5.

I don't have any version in between.

Status: 
Closed (fixed)

Comments

Submitted by andreychek on Thu, 06/28/2012 - 17:40

Howdy -- when hashed passwords are in use, the MySQL password is set to a different, and random, password. You can see the password by going into Edit Databases.

The reason for that is since most web apps require the MySQL password be stored in plain text within the config files, it wouldn't make sense to use hashed passwords with the MySQL password sitting there in plain view.

So two different passwords are used -- the regular account password, which is hashed, along with a randomly generated MySQL password.

Submitted by ghomem on Sat, 06/30/2012 - 04:27

I think I see what you mean.

Thanks!