Control Web Panel

WebPanel => MySQL => Topic started by: dario68 on September 03, 2025, 05:07:10 AM

Title: Danger: MySQL root password - BIG SECURITY ISSUE
Post by: dario68 on September 03, 2025, 05:07:10 AM

Hi guys
I just installed fresh CWPpro on Almalinux 8.10 and every night between 2am-3am I've got notification "Danger: MySQL root password - BIG SECURITY ISSUE - MySQL root login with any password is possible !!!"

Has anyone encountered a similar problem?

Distro Name: AlmaLinux release 8.10 (Cerulean Leopard)
MySQL version: 10.11.14-MariaDB

links to screenshots:
https://drive.google.com/file/d/1uM-Nrgu6p4lCQUPzPPJYUdRju1FkcTHn/view?usp=drive_link
https://drive.google.com/file/d/15sCExe3_o5g-TU9P6ku8AfzmqI0EEOSU/view?usp=drive_link

Title: Re: Danger: MySQL root password - BIG SECURITY ISSUE
Post by: overseer on September 03, 2025, 11:53:47 AM

Have you run mariadb_secure_installation ?
https://mariadb.com/docs/server/clients-and-utilities/deployment-tools/mariadb-secure-installation

Title: Re: Danger: MySQL root password - BIG SECURITY ISSUE
Post by: dario68 on September 03, 2025, 04:53:23 PM

yes, that was the first thing I did

Title: Re: Danger: MySQL root password - BIG SECURITY ISSUE
Post by: Starburst on September 03, 2025, 07:00:53 PM

That almost looks like MariaDB was installed before CWP.
Which will work, but then CWP skips the MariaDB configuration, and just creates it's needed databases.

I have NEVER gotten that message on any CWP installation I've done back on AlmaLinux 8 or AlmaLinux 9.

Title: Re: Danger: MySQL root password - BIG SECURITY ISSUE
Post by: overseer on September 03, 2025, 07:17:59 PM

Did you try resetting the MariaDB root p/w to something secure?
https://www.digitalocean.com/community/tutorials/how-to-reset-your-mysql-or-mariadb-root-password

Make sure CWP knows about the new p/w -- it should be set in these two files:
/usr/local/cwpsrv/htdocs/resources/admin/include/db_conn.php
/root/.my.cnf

Title: Re: Danger: MySQL root password - BIG SECURITY ISSUE
Post by: dario68 on September 05, 2025, 06:32:03 AM

thank you guys for reply

@Starburst - the installation procedure was:
1. Installed AlmaLinux-8.10-x86_64-minimal
2. Installed CWP based on "Quick guide CentOS 8/ Almalinux 8" https://control-webpanel.com/installation-instructions#step4
3. upgraded MariaDB to 10.11 based on this tutorial:  https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/upgrade-mariadb-10-x-to-10-11-in-cwp-on-almalinux-8 (BTW thanks for great knowledge base)

@overseer - I will try to reset the root password and let you know tomorrow