my.cnf password in plain text

[vintagegamingsystems]

Hello,
I have a Zabbix agent monitoring a MySQL database on a host machine. This past week I was able to get that going with the help of a tchjts1 . While I was looking around I found I realized that I have my password in plaintest in my my.cnf file. I was trying to secure the password by changing the permissions of the file, which is the suggestion of the mysql development site. http://dev.mysql.com/doc/refman/5.1/...rity-user.html

Store your password in an option file. For example, on Unix, you can list your password in the [client] section of the .my.cnf file in your home directory:

[client]
password=your_pass

To keep the password safe, the file should not be accessible to anyone but yourself. To ensure this, set the file access mode to 400 or 600. For example:

shell> chmod 600 .my.cnf

To name from the command line a specific option file containing the password, use the --defaults-file=file_name option, where file_name is the full path name to the file. For example:

shell> mysql --defaults-file=/home/francis/mysql-opts

Section 4.2.3.3, “Using Option Files”, discusses option files in more detail.

I changed the permissions to 400 and 600 but when I did that the mysql agent could not read the my.cnf file and thus stated on the Frontend that the MySQL server was down. I also put the hash of the file in the MySQL "Select * from mysql.user;" into the my.cnf but that didn't work either. I probably need to give the zabbix_agent root permissions but I am not sure how to do that. If anyone knows a solution it would be greatly appreciated. Thanks.

[vintagegamingsystems]

Is "Allow Root" in the configuration file safe?

I was wondering if allowing the zabbix_agentd root access is safe? I think that might solve my problem with my.cnf file. I am just not sure if it is the safest approach. Any suggestions would be greatly appreciated.

[vintagegamingsystems]

I fixed it.

I fixed it. The problem is that the agent needs to have access to the file. It does not have root access and I am not going to give it root access for security reasons. I made the zabbix group the owner of the my.cnf file. So I changed my permissions for the file to 640. It should work. If anyone knows any other way to do this, it would be much appreciated.

[alainchiasson]

Place password in user cnf file

If the zabbix user has a home directory, try putting the passowrd in a .my.cnf file that only the user has access to.

Mysql will try and load athe configurations in the following order

"/etc/my.cnf",
"/etc/mysql/my.cnf"
"/usr/etc/my.cnf"
"/home/zabbix/.my.cnf"
"/home/zabbix/.mylogin.cnf"

This is hard coded in the code !! The configs in later files takes precedence. So the Zabbix owned file can be as little as :

[client]
password = root

And all other config will be taken from the previous files. At that point you can relax the settings on the global config file.