On my CentOS testing server, someone has changed the MySQL root password. Is there any way to find out, who changed the password and when?
First, if the user performed “root” password change from a remote machine and MySQL logging was not enabled, there would basically be no logs of any value anywhere you have access to that would connect a user to that specific action. But assuming the user was logged in via a command line session, there are a few things you check that might provide some clues.
Since any user running MySQL from the command line would automatically create a
.mysql_history in their home directory you could run a command like this on the system to see if it snags anything:
grep -i -e "password" /home/*/.mysql_history
That would do a case insensitive search through each user’s
.mysql_history file looking for the word
password assuming they change the password via being in the MySQL client itself and using the client itself to change the password.
But you could also look through their
.bash_history to see anyone used MySQL at all and then maybe focus on them as a potential suspect
grep -i -e "mysql" /home/*/.bash_history
That would do a case insensitive through each user’s
.bash_history file looking for the word
mysql which would mean they ran—or attempted to run—something MySQL connected from the command line.
But that is all assuming that the user in question did not erase or alter their their
.mysql_history files to cover their tracks. If they were knowledgable enough to erase those history files, not too sure you can track them past that unless MySQL logging was enabled. And MySQL logging is typically disabled by default due to the negative performance impact it has on a system.
All that said, if this MySQL setup has other users enabled, be open to the idea that perhaps someone was assigned a user that might have been different from “root” but was granted effectively the same level of permissions as “root.” Meaning they could have used their supposedly non-“root” account to do whatever they wanted to do.
Fast, loose and non-secure MySQL grants are disturbingly common out there and often put in place by database administrators who for—whatever reason—simply setup a separate “non-root” account and then just use a
GRANT ALL PRIVILEGES ON *.* TO 'username'@'localhost'; when assigning rights to the new user. Horrible idea since that
GRANT ALL PRIVILEGES ON *.* basically means, “Let this user do anything on any database, just as if they were a root user.”