Installing on a host that already runs MariaDB¶

IDSTower can share a MariaDB server with other applications. The installation script needs to log in to that server as an administrator, and on a server that is already in use it cannot work out that login by itself, so it stops and asks you for it.

Why the installation script stops¶

A fresh MariaDB from your distribution lets root log in through the local socket whatever password is given, so the password the script generates for it is accepted.

A server that already has a real root password, set for another application or by an administrator, refuses the generated one. The script stops at that point with this message, before it creates any database or user:

The database server on 'localhost' refused the administrator login 'root'.

Give the script the real login¶

Open the credentials file IMPORTANT_idstower_installation_script_generated_credentials. The script wrote it to the directory you ran it from, or to your home directory if that one was not writable.
Set DatabaseAdminUsername and DatabaseAdminPassword to a login that works on this server, and leave the other lines as they are. Write the password as it is, with no quoting, whatever characters it holds:
```
DatabaseAdminUsername=root
DatabaseAdminPassword=Real$Pass word&1
```
Run the installation script again, from the same directory:
```
$ bash install-IDSTower.sh -i
```

The script reads the file as plain NAME=value lines and keeps the password as you wrote it on every later run. A pair of quotes around the whole value is taken off.

Note

Installation script versions before 1.7 run this file as a shell script. A password holding $, a space or & has to be wrapped in single quotes there:

DatabaseAdminPassword='Real$Pass word&1'

Those versions rewrite the file without the quotes, so add them again before each re-run.

What the installation script does on that server¶

With a login that works, the script:

creates the idstower database user, 'idstower'@'localhost', and gives it all privileges on the IDSTower database
creates the IDSTower database
enables and starts mariadb.service

It leaves the other databases, the other users and the server’s configuration alone. The administrator login keeps the password it has.

Two things to know before you run it:

The script installs the MariaDB server package as it does on any host, so the package manager can upgrade an older package to the newest version its repositories offer. On the RHEL 8 family it first writes MariaDB’s 10.6 repository to /etc/yum.repos.d/mariadb.repo, replacing a file of that name, and installs version 10.6 from it.
On the RHEL family and Amazon Linux, if root can log in with an empty password, which includes logging in through the local socket, the script sets root’s password to the DatabaseAdminPassword in the credentials file. An application that relies on that login needs the new password from then on, so plan for that before you run the script.

Privileges the login needs¶

The login does not have to be root, with one exception: on the RHEL family and Amazon Linux, when root can log in with an empty password or through the local socket, the script sets that password using the login you wrote, so a login other than root stops the run there. Use root on such a host. The login needs these privileges:

GRANT CREATE USER, RELOAD ON *.* TO <account>;
GRANT ALL ON IDSTower.* TO <account> WITH GRANT OPTION;

To check a login, connect with it and run:

SHOW GRANTS FOR CURRENT_USER;

For root, look at the GRANT ALL PRIVILEGES ON *.* line in particular: that line has to end with WITH GRANT OPTION. MariaDB also prints a second line, GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION, even for a root that has lost its grant option, so seeing those words somewhere in the output proves nothing.

A root whose GRANT ALL PRIVILEGES ON *.* line ends without WITH GRANT OPTION can log in and create users, but gets ERROR 1044 at the script’s GRANT step. It cannot repair itself, because giving the option back takes the option.

Restoring the grant option when there is no other administrator¶

Warning

Use this only on a host with no other administrator login. These commands restart MariaDB twice, so every application using the server loses its connection. While the server runs without its grant tables anyone on the host can log in with every privilege, and --skip-networking keeps it off the network during that time.

$ sudo systemctl set-environment MYSQLD_OPTS="--skip-grant-tables --skip-networking"
$ sudo systemctl restart mariadb
$ sudo mariadb -e "FLUSH PRIVILEGES; GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;"
$ sudo systemctl unset-environment MYSQLD_OPTS
$ sudo systemctl restart mariadb

Do not remove MariaDB to get past this¶

Warning

Do not remove MariaDB to get past the refused login if anything else uses it. apt-get purge mariadb-server alone keeps /var/lib/mysql, so the old password survives a reinstall and the script stops in the same place. Deleting that directory deletes every database on the server.

If the client reports `unknown variable 'bind-address=...'`¶

bind-address belongs under [mysqld] in the server’s configuration. Under [client-server] or [client] the client reads it too and stops with unknown variable 'bind-address=...'. Move the line under [mysqld] and run the script again.

If a web server holds port 80 or 443¶

IDSTower listens on port 443, and on port 80 to redirect to it. If a web server on the same host holds either one, give IDSTower another port, on every run of the script:

$ bash install-IDSTower.sh -i -n <hostname>:<port>

IDSTower then listens on that port alone. The script only opens ports 80 and 443 in the firewall, so the port you choose is yours to open.