diff options
Diffstat (limited to 'lib/modules/mysql_user2')
| -rw-r--r-- | lib/modules/mysql_user2 | 43 |
1 files changed, 2 insertions, 41 deletions
diff --git a/lib/modules/mysql_user2 b/lib/modules/mysql_user2 index dc9a69e..acceeaf 100644 --- a/lib/modules/mysql_user2 +++ b/lib/modules/mysql_user2 @@ -90,67 +90,66 @@ options: check_implicit_admin: description: - Check if mysql allows login as root/nopassword before trying supplied credentials. required: false type: bool default: no version_added: "1.3" notes: - Requires the MySQLdb Python package on the remote host. For Ubuntu, this is as easy as apt-get install python-mysqldb. - Both C(login_password) and C(login_username) are required when you are passing credentials. If none are present, the module will attempt to read the credentials from C(~/.my.cnf), and finally fall back to using the MySQL default login of 'root' with no password. - "MySQL server installs with default login_user of 'root' and no password. To secure this user as part of an idempotent playbook, you must create at least two tasks: the first must change the root user's password, without providing any login_user/login_password details. The second must drop a ~/.my.cnf file containing the new root credentials. Subsequent runs of the playbook will then succeed by reading the new credentials from the file." -requirements: [ "ConfigParser", "MySQLdb" ] +requirements: [ "MySQLdb" ] author: Mark Theunissen ''' EXAMPLES = """ # Create database user with name 'bob' and password '12345' with all database privileges - mysql_user: name=bob password=12345 priv=*.*:ALL state=present # Ensure no user named 'sally' exists, also passing in the auth credentials. - mysql_user: login_user=root login_password=123456 name=sally state=absent # Example privileges string format mydb.*:INSERT,UPDATE/anotherdb.*:SELECT/yetanotherdb.*:ALL # Example using login_unix_socket to connect to server - mysql_user: name=root password=abc123 login_unix_socket=/var/run/mysqld/mysqld.sock # Example .my.cnf file for setting the root password # Note: don't use quotes around the password, because the mysql_user module # will include them in the password but the mysql client will not [client] user=root password=n<_665{vS43y """ -import ConfigParser import getpass import tempfile try: import MySQLdb except ImportError: mysqldb_found = False else: mysqldb_found = True # =========================================== # MySQL module specific support methods. # def user_exists(cursor, user, host): cursor.execute("SELECT count(*) FROM user WHERE user = %s AND host = %s", (user,host)) count = cursor.fetchone() return count[0] > 0 def load_plugin(cursor, plugin, soname): cursor.execute("SELECT count(*) FROM information_schema.plugins WHERE plugin_name = %s", plugin) @@ -351,70 +350,40 @@ def _safe_cnf_load(config, path): for line in f.readlines(): line = line.strip() if line.startswith('user='): data['user'] = line.split('=', 1)[1].strip() if line.startswith('password=') or line.startswith('pass='): data['password'] = line.split('=', 1)[1].strip() f.close() # write out a new cnf file with only user/pass fh, newpath = tempfile.mkstemp(prefix=path + '.') f = open(newpath, 'wb') f.write('[client]\n') f.write('user=%s\n' % data['user']) f.write('password=%s\n' % data['password']) f.close() config.readfp(open(newpath)) os.remove(newpath) return config -def load_mycnf(): - config = ConfigParser.RawConfigParser() - mycnf = os.path.expanduser('~/.my.cnf') - if not os.path.exists(mycnf): - return False - try: - config.readfp(open(mycnf)) - except (IOError): - return False - except: - config = _safe_cnf_load(config, mycnf) - - # We support two forms of passwords in .my.cnf, both pass= and password=, - # as these are both supported by MySQL. - try: - passwd = config_get(config, 'client', 'password') - except (ConfigParser.NoOptionError): - try: - passwd = config_get(config, 'client', 'pass') - except (ConfigParser.NoOptionError): - return False - - # If .my.cnf doesn't specify a user, default to user login name - try: - user = config_get(config, 'client', 'user') - except (ConfigParser.NoOptionError): - user = getpass.getuser() - creds = dict(user=user,passwd=passwd) - return creds - def connect(module, login_user, login_password): if module.params["login_unix_socket"]: db_connection = MySQLdb.connect(host=module.params["login_host"], unix_socket=module.params["login_unix_socket"], user=login_user, passwd=login_password, db="mysql") else: db_connection = MySQLdb.connect(host=module.params["login_host"], port=int(module.params["login_port"]), user=login_user, passwd=login_password, db="mysql") return db_connection.cursor() # =========================================== # Module execution. # def main(): module = AnsibleModule( argument_spec = dict( login_user=dict(default=None), login_password=dict(default=None, no_log=True), login_host=dict(default="localhost"), login_port=dict(default=3306, type='int'), login_unix_socket=dict(default=None), user=dict(required=True, aliases=['name']), @@ -435,49 +404,41 @@ def main(): priv = module.params["priv"] check_implicit_admin = module.params['check_implicit_admin'] append_privs = module.boolean(module.params["append_privs"]) auth_plugin = module.params['auth_plugin'] soname = module.params['soname'] if not mysqldb_found: module.fail_json(msg="the python mysqldb module is required") if priv is not None: try: priv = privileges_unpack(priv) except: module.fail_json(msg="invalid privileges string") # Either the caller passes both a username and password with which to connect to # mysql, or they pass neither and allow this module to read the credentials from # ~/.my.cnf. login_password = module.params["login_password"] login_user = module.params["login_user"] - if login_user is None and login_password is None: - mycnf_creds = load_mycnf() - if mycnf_creds is False: - login_user = "root" - login_password = "" - else: - login_user = mycnf_creds["user"] - login_password = mycnf_creds["passwd"] - elif login_password is None or login_user is None: + if login_password is None or login_user is None: module.fail_json(msg="when supplying login arguments, both login_user and login_password must be provided") cursor = None try: if check_implicit_admin: try: cursor = connect(module, 'root', '') except: pass if not cursor: cursor = connect(module, login_user, login_password) except Exception as e: module.fail_json(msg="unable to connect to database, check login_user and login_password are correct or ~/.my.cnf has the credentials") if state == "present": if user_exists(cursor, user, host): changed = user_mod(cursor, user, host, password, priv, append_privs, auth_plugin) else: if (password is None and auth_plugin is None) or (password is not None and auth_plugin is not None): |