☰

Ansible：mysql_user 对非 root 用户不起作用

tag-icon • tag-icon mysql ansible mariadb
Ansible：mysql_user 对非 root 用户不起作用

我正在尝试设置一个简单的 Ansible 脚本来设置 MariaDB 安装。但是出于某种原因，我可以成功更改 root 用户的密码，在下次运行时使用新密码以 root 身份登录，成功创建数据库，但如果我尝试在mysql_user任何其他用户上使用，它总是会失败。

剧本：

---
- hosts: all
  become: true
  remote_user: centos
  vars:
    rootpwd: Password1
    replipwd: Password2
    dbname: tests
  tasks:
  - name: Installing packages
    yum: name={{item}} state=latest
    with_items:
     - mariadb
     - mariadb-server
     - mariadb-devel
  - name: Installing Python module
    pip: name=MySQL-python
  - name: Server configuration
    lineinfile: dest=/etc/my.cnf line={{ item }} mode=0644 create=yes
    with_items:
    - bind-address=0.0.0.0
    - log-bin
    - server_d={{ ansible_all_ipv4_addresses[0].split('.')[3] }}
    - log-basename=log{{ ansible_all_ipv4_addresses[0].split('.')[3] }}
  - name: Restarting services
    service: state=restarted name=mariadb enabled=yes
  - name: Securing root account
    mysql_user: name=root password={{ rootpwd }} priv=*.*:ALL state=present
  - name: Client configuration
    lineinfile: dest=/root/.my.cnf line={{ item }} mode=0600 create=yes
    with_items:
    - "[client]"
    - user=root
    - password={{ rootpwd }}
  - name: Making database
    mysql_db: name={{ dbname }} state=present
  - name: Making replication user
    mysql_user: name=replicate password={{ replipwd }} priv="*.*:REPLICATION SLAVE" state=present host="%"

跑步：

...
TASK [Restarting services] *****************************************************
task path: /home/centos/.ansible/centos-mariadb.playbook:25
changed: [172.30.1.21] => {"changed": true, "enabled": true, "name": "mariadb", "state": "started"}
changed: [172.30.1.38] => {"changed": true, "enabled": true, "name": "mariadb", "state": "started"}

TASK [Securing root account] ***************************************************
task path: /home/centos/.ansible/centos-mariadb.playbook:27
ok: [172.30.1.38] => {"changed": false, "user": "root"}
ok: [172.30.1.21] => {"changed": false, "user": "root"}

TASK [Client configuration] ****************************************************
task path: /home/centos/.ansible/centos-mariadb.playbook:30
ok: [172.30.1.21] => (item=[client]) => {"backup": "", "changed": false, "item": "[client]", "msg": ""}
ok: [172.30.1.38] => (item=[client]) => {"backup": "", "changed": false, "item": "[client]", "msg": ""}
ok: [172.30.1.21] => (item=user=root) => {"backup": "", "changed": false, "item": "user=root", "msg": ""}
ok: [172.30.1.38] => (item=user=root) => {"backup": "", "changed": false, "item": "user=root", "msg": ""}
ok: [172.30.1.21] => (item=password=Password1) => {"backup": "", "changed": false, "item": "password=Password1", "msg": ""}
ok: [172.30.1.38] => (item=password=Password1) => {"backup": "", "changed": false, "item": "password=Password1", "msg": ""}

TASK [Making database] *********************************************************
task path: /home/centos/.ansible/centos-mariadb.playbook:36
ok: [172.30.1.21] => {"changed": false, "db": "tests"}
ok: [172.30.1.38] => {"changed": false, "db": "tests"}

TASK [Making replication user] *************************************************
task path: /home/centos/.ansible/centos-mariadb.playbook:38
fatal: [172.30.1.21]: FAILED! => {"changed": false, "failed": true, "msg": "(1045, \"Access denied for user 'root'@'localhost' (using password: YES)\")"}
fatal: [172.30.1.38]: FAILED! => {"changed": false, "failed": true, "msg": "(1045, \"Access denied for user 'root'@'localhost' (using password: YES)\")"}

NO MORE HOSTS LEFT *************************************************************

从 shell 手动连接可以正常工作：

$ sudo mysql
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 6
Server version: 5.5.50-MariaDB MariaDB Server

答案1

经过几个小时的努力，我终于修复了它。结果发现这一行代码中有 3 个错误：

- name: Securing root account
  mysql_user: name=root password={{ rootpwd }} priv=*.*:ALL state=present host=localhost

首先，您可能认为priv这会授予 root 所有访问权限，但实际上这会删除GRANT访问权限，因此您从此无法创建新用户。此外，您可能认为这会将访问权限限制为仅限 localhost，但实际上它会创建一个具有 localhost 访问权限的新 root 用户。最后，您可能认为您正在更改 root 的密码，但您只为刚刚从 localhost 创建的一个用户设置了密码。还有 4 个 root 用户的密码为空。

这就是我最终不得不做的事情：

- name: Securing root account
  mysql_user: name=root password={{ rootpwd }} state=present host=localhost
- name: Remove anonymous users
  raw: mysql -e "DELETE FROM mysql.user WHERE user='';"
- name: Set root permission
  raw: mysql -e "DELETE FROM mysql.user WHERE user='root' AND host!='localhost';"

相关内容