DirectAdmin 1.714

[fln]

We are happy to announce the release of DirectAdmin 1.714.

A full release change log is here:

DirectAdmin 1.714​

The update should be automatically available for all installations subscribed to the current release channel.

We appreciate all the feedback on forums and issues reported in the ticketing system.

Thanks!

 

[Ohm J]

Version 1.714 | DirectAdmin Docs

DirectAdmin Knowledge Base

docs.directadmin.com

what's this meaning ?

Is it separate unix-socket handle from normal user application ? And normal user can't using PHP to connect to these socket-handle on root account, right ?

 

[fln]

It is the same UNIX socket that normal applications use. If MySQL/MariaDB server detects that the other end of UNIX socket (client side) is running as root process (UID 0) then it allows the connection without password.

It works by using the unix_socket authentication plugin for MariaDB or auth_socket authentication plugin for MySQL. For MariaDB the authentication plugin is built-in, for MySQL servers it is loaded by adjusting the MySQL server startup parameters in the systemd service file.

Note: This does not affect existing installations. The code to set-up password-less logins for root is executed only when CustomBuild performs the initial MySQL/MariaDB install (when it initializes the mysql data directory). Old behaviour was to set root account password to be the same as da_user account password. After initial install CB does not touch the root account credentials.

And normal user can't using PHP to connect to these socket-handle on root account, right ?

If PHP process is running as root it can connect without password. If it runs under different UNIX user it will not be able to connect as root. The authentication plugin checks for the client process UID (asks the kernel to check to be more precise, so it is reliable and does not require any userspace process checking).

---

The implementation is trivial, on fresh installs CB executes:

ALTER USER root@localhost IDENTIFIED WITH unix_socket;
or:
ALTER USER root@localhost IDENTIFIED WITH auth_socket;

This single query is enough to replace root account password with password-less mode. It can be used on existing servers. But CB will not do this automatically. For the time being... .