Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been bitten several times by the 'debian-sys-maint' user that is installed by default on the mysql-server packages installed from the Ubuntu repositories.

Generally what happens is I pull a fresh copy of our production database (which is not running on Debian/Ubuntu) for troubleshooting or new development and forget to exclude the mysql.user table hence losing the debian-sys-maint user.

If we add new mysql users for whatever reason, I have to 'merge' these into my development environment as opposed to just overlaying the table.

Without the user my system still seems functional, but plagued with errors such as:

sudo /etc/init.d/mysql restart
Stopping MySQL database server: mysqld...failed.
error: 'Access denied for user 'debian-sys-maint'@'localhost' (using password: YES)'
  • What is debian-sys-maint used for?
    • Is there a better way for the package maintainers to do what they're trying to do?
  • What is the easiest way to restore it after I've lost it?
  • What is the correct/minimal set of privileges for this user?
    • Seems like poor idea to 'grant all privileges on *.* ...'

Edit

Additional question - Is the password in /etc/mysql/debian.cnf already hashed or is this the plaintext password? It matters when you go to recreate the user and I never seem to get it right on the first try.

Thanks

share|improve this question
4  
The password is plaintext in /etc/mysql/debian.cnf –  Brent May 20 '09 at 13:52

7 Answers 7

up vote 26 down vote accepted

What is debian-sys-maint used for?

By default it is used for telling the server to roll the logs. It needs at least the reload and shutdown privilege.

See the file /etc/logrotate.d/mysql-server

It is used by the /etc/init.d/mysql script to get the status of the server. It is used to gracefully shutdown/reload the server.

Here is the quote from the README.Debian

* MYSQL WON'T START OR STOP?:
=============================
You may never ever delete the special mysql user "debian-sys-maint". This user 
together with the credentials in /etc/mysql/debian.cnf are used by the init 
scripts to stop the server as they would require knowledge of the mysql root 
users password else.


What is the easiest way to restore it after I've lost it?

The best plan is to simply not loose it.

You could use a command like this to build a sql file that you can use later to recreate the account.

mysqldump --complete-insert --extended-insert=0 -u root -p mysql | grep 'debian-sys-maint' > debian_user.sql


Is the password in /etc/mysql/debian.cnf already hashed

The password is not hashed.

share|improve this answer

If you need to add the debian-sys-maint user just for logrotate.d purposes, you should not grant ALL PRIVILEGES or the GRANT OPTION -- this is an unnecessary giant security hole. Instead, you can just add the user with the RELOAD privilege like this (assuming you are accessing your db as root, and you replace xxxxxx with your password)

# add the user with the reload right
GRANT RELOAD on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'xxxxxx'; 

# reload the rights
FLUSH PRIVILEGES;

# double check
select * from mysql.user;
share|improve this answer
    
This is the single secure answer at it grants only required permissions to debian-sys-maint. Also, I can confirm that it works like a charm. Cheers! –  Jealie Aug 29 at 16:04

Instead of

GRANT ALL PRIVILEGES on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY PASSWORD('your password') WITH GRANT OPTION; FLUSH PRIVILEGES;

I think

GRANT ALL PRIVILEGES on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'your password' WITH GRANT OPTION; FLUSH PRIVILEGES;

because the password is not hashed ...?

share|improve this answer

I wanted to just comment, but I think correct syntax deserves it's own entry. This will create the debian-sys-maint user:

mysql> GRANT ALL PRIVILEGES on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'plaintextpassword' WITH GRANT OPTION; FLUSH PRIVILEGES;

If you still have the /etc/mysql/debian.cnf file, just use the password in there.

Feel free to come up with a more paranoid secure solution.

share|improve this answer

You could also:

sudo dpkg-reconfigure mysql-server-5.0

Which will give you the option to recreate the debian-sys-maint user. Existing users and databases are safe.

share|improve this answer

As a side note to this, take a look at this mysqlperformanceblog post for reasons why you might want to disable the debian-specific stuff.

share|improve this answer
    
"Note that this shouldn’t be a problem with MySQL from Debian lenny, as it ships with init-scripts which will not run CHECK TABLE on non-MYISAM tables." -- from the linked page –  d-_-b Apr 23 '13 at 5:38

The debian-sys-maint user is by default a root equivalent. It is used by certain maintenance scripts on Debian systems, and as a side-effect, allows users with root access on the box to view the plaintext password in /etc/mysql/debian.cnf (good or bad?)

You can re-create the user by:

GRANT ALL PRIVILEGES on *.* TO debian-sys-maint@localhost IDENTIFIED BY PASSWORD('your password') WITH GRANT OPTION; FLUSH PRIVILEGES;

Just make sure the password matches that in /etc/mysql/debian.cnf

share|improve this answer
5  
Re (good or bad) - If someone manages to become root they can bypass the privilege system entirely by simply restarting the server with the correct options. If you an attacker gets root, you probably have bigger problems then that configuration file. –  Zoredache May 19 '09 at 16:53
    
also re: good or bad - I've had to rely on the debian-sys-maint access to re-set the MySQL root account password when it had been forgotten. It was nice having this fallback option. –  Brent May 19 '09 at 17:58
1  
@Brent: See dev.mysql.com/doc/refman/5.0/en/resetting-permissions.html for how to reset mysql root password. I've disabled this user on many mysql installs on Debian as it can cause havoc at startup with checking tables if they are large tables. –  Nathan May 20 '09 at 0:23
    
Nathan, thanks for that link. That's new info for me. If you have a procedure for disabling the debian-sys-maint account altogether, why don't you include it here as a separate answer. That would be great! –  Brent May 20 '09 at 13:57
2  
a better grant would be just to give the shutdown/startup privileges. –  jmtd Aug 25 '10 at 9:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.