How to have different passwords for MariaDB, VM login and Usermin

DarkCorner · April 11, 2024, 11:10pm

When I create a Virtual Server I define a password, but I would like to use a different password for MariaDB and possibly also for Usermin. I will also install the scripts for Roundcube and phpMyAdmin.

SYSTEM INFORMATION
OS type and version	Debian 12
Webmin version	2.105
Virtualmin version	7.10.0
Related packages	MariaDB, scripts

shoulders · April 12, 2024, 6:54am

This is a Pro feature recently added in VM 7.10

Add reworked Edit Users page with ability to add separate database and webserver users

github.com/virtualmin/virtualmin-gpl

Feature: The ability to add MariaDB database users with their own password and assign them to a choosen database

opened 03:00PM - 14 Nov 23 UTC

shoulders

| SYSTEM INFORMATION|| |----------------------|---------------------------| |… OS type and version | Ubuntu Linux 22.04.3 | | Webmin version | 2.101 | | Usermin version | 2.001 | | Virtualmin version | 7.8.2 | | Theme version | 21.04 | | Package updates | 5 package updates are available | ### Explain the issue I don't understand why there is only one MariaDB username and password as this can't be safe. If one of your CMS gets compromised, the rest probably will do as I guarantee that hackers know that Virtualmin shares SQL credentials (by defaul) across a whole account/virtual server. I do come from the cPanel world where I could create and independent Database username and password and then assign it to a database of my choice, and it is this that I would like in Virtualmin. - I do not want to expose my virtual server username - If i change the MariaDB password I have to change it on all of my CMS. - A CMS with these details can access other databases - this does default practice does not seem safe, - Virtualmin users (i.e. clients) cannot be using Webmin to setup their databases. it should all be handled in module. ### Workaround Create MariaDB user with Webmin, and then assign it to your choosen database. Give these credentials out instead. This adds a lot of work if you have more than a couple of websites, i.e. clients. ### Proposed Solution Update the 2 following tabs, maybe into one allow the adding of additional SQL users. These would be only for this virtual server and its sub-servers,this also addresses #135. Virtualmin --> Edit Database --> Usernames Virtualmin --> Edit Database --> Passwords Maybe a simple wizard like cPanel but this is definitely optional. thanks

I might be closing this issue, but it is just for reference.

DarkCorner · April 12, 2024, 8:25am

Ok, then I’ll buy the license next.
Then what should I do to have separate passwords?
I see that already installing Roundcube I received the password error.

shoulders · April 12, 2024, 9:39am

I have not installed Roundcube on VM so I don’t know about the install process and if this requires any usernames and passwords. Maybe you create the DB user first and then you can select it in the script?

Ilia · April 12, 2024, 9:39am

It depends on the user type. For mail clients, a Unix user account is used along with its password. For databases, it’s possible to set a different password on the Edit Databases page.

DarkCorner · April 12, 2024, 3:30pm

Yesterday, with the GPL version, I changed the user password in MariaDB because it had to be used in Joomla, which I installed without using the script because I already had a restore of a previous website.

Now, with a Pro license, if I install Roundcube I get:

Found https://github.com:443/roundcube/roundcubemail/releases/download/1.6.6/roundcubemail-1.6.6-complete.tar.gz in cache ..

Configuring webserver PHP settings ..
.. already done
Now installing RoundCube version 1.6.6 ..
Database connection failed : mysql::execute_sql failed : DBI connect failed : Access denied for user 'user-db'@'localhost' (using password: YES)  
.. failed! See the error message above for the reason why.
Re-loading Webmin ..
.. done

In general I would not like to have only one user for all databases used in a domain.

jimr1 · April 12, 2024, 3:37pm

I would assume that the script installer looks at the domain owner password when installing a script. As you have changed the mysql password this would be the failure. Maybe following step 2 in this article would have been a better option to set up your app How to Change the Database Password in Joomla? | itoctopus