On my CentOS testing server, someone has changed the MySQL root password. Is there any way to find out, who changed the password and when?

  • I think that logging is enabled by default in MySQL. Checkout the mysqlbinlog command. – ott-- Mar 24 '15 at 21:48
  • “I think that logging is enabled by default in MySQL.” 100% nope. “By default, no logs are enabled…” – Giacomo1968 Mar 25 '15 at 5:38

First, if the user performed “root” password change from a remote machine and MySQL logging was not enabled, there would basically be no logs of any value anywhere you have access to that would connect a user to that specific action. But assuming the user was logged in via a command line session, there are a few things you check that might provide some clues.

Since any user running MySQL from the command line would automatically create a .mysql_history in their home directory you could run a command like this on the system to see if it snags anything:

grep -i -e "password" /home/*/.mysql_history

That would do a case insensitive search through each user’s .mysql_history file looking for the word password assuming they change the password via being in the MySQL client itself and using the client itself to change the password.

But you could also look through their .bash_history to see anyone used MySQL at all and then maybe focus on them as a potential suspect

grep -i -e "mysql" /home/*/.bash_history

That would do a case insensitive through each user’s .bash_history file looking for the word mysql which would mean they ran—or attempted to run—something MySQL connected from the command line.

But that is all assuming that the user in question did not erase or alter their their .bash_history or .mysql_history files to cover their tracks. If they were knowledgable enough to erase those history files, not too sure you can track them past that unless MySQL logging was enabled. And MySQL logging is typically disabled by default due to the negative performance impact it has on a system.

All that said, if this MySQL setup has other users enabled, be open to the idea that perhaps someone was assigned a user that might have been different from “root” but was granted effectively the same level of permissions as “root.” Meaning they could have used their supposedly non-“root” account to do whatever they wanted to do.

Fast, loose and non-secure MySQL grants are disturbingly common out there and often put in place by database administrators who for—whatever reason—simply setup a separate “non-root” account and then just use a GRANT ALL PRIVILEGES ON *.* TO 'username'@'localhost'; when assigning rights to the new user. Horrible idea since that GRANT ALL PRIVILEGES ON *.* basically means, “Let this user do anything on any database, just as if they were a root user.”

| improve this answer | |
  • 1
    You can change passwords over the network, or through software that would leave no logs. If your server is open to the network I can use my local mysql client. Or a password might be changed by some software like a PHPMyAdmin, or something else if that is on the web server. There may simple be no logs. – Zoredache Mar 24 '15 at 21:18
  • @Zoredache Very good point. Edited my question to add that context. – Giacomo1968 Mar 24 '15 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.