postinst fails when settings in debian.cnf no longer work

[Bodo Brance]

After an apt-get upgrade today, mysql-server-5.6 got uninstalled, but nothing came to replace it.
I therefore used apt-get install mysql-server to get the latest 5.7, but it could not be configured (dpkg threw out error 11, about 5.7 not being configured).

ProblemType: Package
DistroRelease: Ubuntu 16.04
Package: mysql-server-5.7 (not installed)
ProcVersionSignature: Ubuntu 4.4.0-17.33-lowlatency 4.4.6
Uname: Linux 4.4.0-17-lowlatency x86_64
NonfreeKernelModules: talpa_vfshook talpa_pedconnector talpa_pedevice talpa_vcdevice talpa_core talpa_linux talpa_syscallhook zfs zunicode zcommon znvpair zavl
ApportVersion: 2.20.1-0ubuntu1
Architecture: amd64
Date: Thu Apr 7 19:11:30 2016
ErrorMessage: subprocess installed post-installation script returned error exit status 11
InstallationDate: Installed on 2016-01-13 (84 days ago)
InstallationMedia: Kubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
RelatedPackageVersions:
 dpkg 1.18.4ubuntu1
 apt 1.2.10
SourcePackage: mysql-5.7
Title: package mysql-server-5.7 (not installed) failed to install/upgrade: subprocess installed post-installation script returned error exit status 11
UpgradeStatus: No upgrade log present (probably fresh install)

[Bodo Brance (bodobr)]

Turns out that when dpkg configures the package, it tries to run mysql_upgrade with the root user and no password, which is insane to do to a database.

I propose that the dpkg prompts the user for a username and then runs:
     mysql_upgrade -u $user -p
and then the user is asked for a password.

[Robie Basak (racb)]

Thank you for taking the time to report this bug and helping to make Ubuntu better.

> Turns out that when dpkg configures the package, it tries to run mysql_upgrade with the root user and no password, which is insane to do to a database.

No, it tries to run mysql_upgrade as the debian-sys-maint user, which it creates on installation and attempts to maintain for this purpose. Doesn't it?

Could you please explain how you ended up with a broken debian-sys-maint user, or otherwise give us steps to reproduce? When done, please change the bug status back to New. Thanks!

[Bodo Brance (bodobr)]

Thanks for the quick answer!

Firstly, as you can see in the attached dpkg terminal log, I believe mysql_upgrade tried to run as (mysql) root:

       ....
       Installing new version of config file /etc/mysql/mysql.conf.d/mysqld.cnf ...
       update-alternatives: using /etc/mysql/mysql.cnf to provide /etc/mysql/my.cnf (my.cnf) in auto mode
                    mysql_upgrade: Got error: 1045: Access denied for user 'root'@'localhost' (using password: NO) while connecting to the MySQL server
       Upgrade process encountered error and will not continue.
       ....

Secondly, regarding the debian-sys-maint DB user, phpMyAdmin tells me it has no password and has "ALL PRIVILEGES".
I noticed this user only today :)).

[Robie Basak (racb)]

Lars, could you take a look please?

[Robie Basak (racb)]

Possibly related: bug 1567695, bug 1567696 or bug 1567696.

@Corneliu, please could you see if you have a ~root/.my.cnf or a ~/.my.cnf (if not using sudo -i or something else that sets $HOME to /root)? If so, please can you report if temporarily renaming them away works?

[Robie Basak (racb)]

Admittedly this may be tricky if you're already finished upgrading. I'd appreciate your thoughts in any case, because it seems likely to me that this may be your issue.

[Lars Tangvald (lars-tangvald)]

We run mysql_upgrade --defaults-file=/etc/mysql/debian.cnf
This doesn't seem to be overriden by .my.cnf files in /root/ or $HOME/, so not entirely sure what's happening here.

Could you check the contents of your /etc/mysql/debian.cnf? I'm wondering if maybe it's missing the needed values, so when the script runs that command as root, it just defaults to root@localhost with no password.

[Lars Tangvald (lars-tangvald)]

The values being missing would also explain why it said your debian-sys-maint has an empty password;
Postinst will try to log in as debian-sys-maint first. If that fails it will try to read the password from debian.cnf and set that as the user's password, then run mysql_upgrade.
I'm thinking that maybe if that login check fails we should simply overwrite the debian.cnf file with a new one.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Bodo Brance (bodobr)]

@Robie, I am using sudo -i for package upgrades.
Typing:
sudo -i
cd ~
ls -al
I do not see a .my.cnf file.
So I do not have something to rename.

I solved my problem by temporarily removing the password for the mysql root@localhost account. mysql_upgrade worked, although it expired the user accounts I was working with.

Trying to reproduce the issue again, I uninstalled and then reinstalled mysql-server (with mysql-server-5.7 & mysql-server-core-5.7) as root. It failed again:

Setting up mysql-server-5.7 (5.7.11-0ubuntu5) ...
update-alternatives: using /etc/mysql/mysql.cnf to provide /etc/mysql/my.cnf (my.cnf) in auto mode
mysql_upgrade: Got error: 1045: Access denied for user 'root'@'localhost' (using password: NO) while connecting to the MySQL server

then I tried as my normal user:

    sudo apt-get -f install

Result:

Setting up mysql-server-5.7 (5.7.11-0ubuntu5) ...
mysql_upgrade: Got error: 1045: Access denied for user 'root'@'localhost' (using password: NO) while connecting to the MySQL server
Upgrade process encountered error and will not continue.

So it looks like it tried root@localhost again.

@Lars, the debian.cnf looks like this:

root@aspire-v3-771:/etc/mysql# cat debian.cnf
# Automatically generated for Debian scripts. DO NOT TOUCH!
[client]
host = localhost
user = root
password =
socket = /var/run/mysqld/mysqld.sock
[mysql_upgrade]
host = localhost
user = root
password =
socket = /var/run/mysqld/mysqld.sock

I guess Postinst did not try to log in with debian-sys-maint and no password.

[Lars Tangvald (lars-tangvald)]

The issue is the contents of your etc/mysql/debian.cnf, then. It should be set up with user=debian-sys-maint and password=something randomly generated.
It could be set up for any user that has the needed privileges for running upgrades, but the idea is that debian-sys-maint will be used by the installation scripts without interfering with other users (and only used for this purpose).

[Bodo Brance (bodobr)]

Okay, so I set up /etc/mysql/debian.cnf as you say, with user debian-sys-maint and a password.

For me it looks great now, but for future installations using sudo -i perhaps it would be great if the user were prompted for a user/pass if the ones provided in debian.cnf are not working. Well, if that were an interactive package install, I guess.

[Lars Tangvald (lars-tangvald)]

If the credentials from the file don't work, we could either try to regenerate it and fix the user, or display a warning to the user that they must run mysql_upgrade, since that's all this user is used for now.

[Robie Basak (racb)]

I disagree with the importance. Low, because this only affects local misconfiguration. The bug is only open because we can make the postinst more robust against this particular case.

[Ricardo Azevedo (ricardofiga)]

After upgrade for ubuntu 16.04 I have the same problem described.

The only way to access my local databases with user root is using this command: sudo mysqld_safe --skip-grant-tables

Any other idea to solve this problem?

Thanks.

[Alan Mimms (alanm-unforgettable)]

I was able to conquer this problem by copying the /etc/mysql/debian.cnf-5.7 to /etc/mysql/debian.cnf and running sudo apt install -f one more time.