From c78788979257e4708105368e55f66362ae05d6b7 Mon Sep 17 00:00:00 2001 From: Mark Tompsett Date: Tue, 18 Sep 2018 13:35:19 +0000 Subject: [PATCH] Bug 20929: Create and Use CNF file Rather than have hostname, username, and passwords on the command line, visible with a ps, use a CNF file so that mysqldump knows them more securely. TEST PLAN ---------- 1) start kohadevbox 2) reset_all 3) sudo systemctl deamon-reload 4) git bz apply 20929 -- choose just this patch 5) restart_all 6) perl /home/vagrant/misc4dev/cp_debian_files.pl 7) sudo koha-dump kohadev 8) in another terminal window: while true; do ls -lah /var/spool/koha/kohadev; sleep 1; done -- there is a koha-dump.cnf file with rw owner only perms in one of the ls runs 9) zcat the backup to make sure the backup has meaningful data in it. BONUS TEST: Change the kohadev DB password, make the koha-conf.xml file match, confirm your kohadev still works, and that a retest of koha-dump still works. Test plan mostly written by Mark Tompsett. --- debian/scripts/koha-dump | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/debian/scripts/koha-dump b/debian/scripts/koha-dump index ff171a0551..3b134f88d9 100755 --- a/debian/scripts/koha-dump +++ b/debian/scripts/koha-dump @@ -68,13 +68,22 @@ dump_instance() backupdir="$( xmlstarlet sel -t -v 'yazgfs/config/backupdir' $kohaconfig || true )" [ -z "$backupdir" ] && backupdir="/var/spool/koha/$name" dbdump="$backupdir/$name-$date.sql.gz" + dboptions="$backupdir/koha-dump.cnf" + # New each time, in case they change the username + # or password. + touch $dboptions + chmod 600 $dboptions + echo "[mysqldump]" > $dboptions + echo "host=$mysqlhost" >> $dboptions + echo "user=$mysqluser" >> $dboptions + echo "password=$mysqlpass" >> $dboptions [ "$quiet" = "no" ] && echo "* DB to $dbdump" - mysqldump --databases --host="$mysqlhost" \ - --user="$mysqluser" --password="$mysqlpass" "$mysqldb" | - gzip > "$dbdump" + mysqldump --defaults-file="$dboptions" \ + --databases "$mysqldb" | gzip > "$dbdump" + # don't leave passwords lying around on the filesystem + rm $dboptions chown "root:$name-koha" "$dbdump" chmod g+r "$dbdump" - instancefile="$name.conf" # Dump configs, logs, etc. -- 2.11.0