Introduce login_user and login_password for user and database creation

[szEvEz]

No description provided.

[fauust]

Hi @szEvEz!
Thanks for your PR.

Can you describe why you think that this is necessary? Also, as you can see, this role is tested with the molecule framework, if we introduce this new feature, I would like to add a test for it. Do you have any suggestion?

[szEvEz]

Hi @fauust,

if I set the root users password and disallow socket_authentication, I need to be able to pass username and password for user and database creation.

I can have a look at writing a test for it!

[fauust]

Ok, rephrasing: why won't you use the socket authentication?

I am just curious about the use case since it seems really not practical to me (in the context of Ansible deployment).

(There might be an excellent reason that I am no aware of)...

[szEvEz]

Ah, got it!

From my point of view this is a security concern. I want to set a password for the root user and disallow socket_authentication because I do not want passwordless authentication for the root user.
There is even a script provided by the initial installation process mysql_secure_installation, which configures these settings.

There were also some comments on this here

To clarify: I don't want any local user (not even root) to be able to connect to the database directly using unix_socket without issuing a password. This is because I setup encryption-at-rest and it would not add too much extra security if one can 'root' the machine and easily circumvent this encryption (by just logging in as root using the unix_socket).

Some weaknesses using this mechanism are documented here as well.

With the arguments I've introduced, the end-user can still chose which path to go, which from my perspective is pretty neat - what do you think?

[fauust]

Ok, so, I am in favor of giving as much flexibility to users but I am wondering if there is not a miss-understanding of what unix_socket authentication is.

Am I understanding correctly that in your setup the root user can't read (or write) the MariaDB data directory ( /var/lib/mysql usually). If that's not the case and if the root user has read/write access to the datadir, then adding a password authentication does not add any extra security (it's the contrary actually).

If that's the case then I understand your point and I am curious of some pointers about how you achieve that (encryption-at-rest ?).