# mariaDB install doesnt pick up password **URL:** https://discourse.roots.io/t/mariadb-install-doesnt-pick-up-password/6137 **Category:** trellis **Created:** 2016-03-07T20:39:09Z **Posts:** 14 ## Post 1 by @daadir — 2016-03-07T20:39:09Z Hey there, Trying to deploy a staging server. Running on a windows machine, i am running the `ansible-playbook server.yml -vvvv -e env=staging` from within Vagrant, in /vagrant . I think i’ve set up everything there is to set, but still i get this error: ``` failed: [ip-address] => (item=localhost) => {"failed": true, "invocation": {"module_args": {"append_privs": false, "check_implicit_admin": true, "config_file": "~/.my.cnf", "encrypted": false, "host": "localhost", "login_host": "localhost", "login_password": null, "login_port": 3306, "login_unix_socket": null, "login_user": null, "name": "root", "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "priv": null, "ssl_ca": null, "ssl_cert": null, "ssl_key": null, "state": "present", "update_password": "always", "user": "root"}, "module_name": "mysql_user"}, "item": "localhost", "msg": "unable to connect to database, check login_user and login_password are correct or /root/.my.cnf has the credentials. Exception message: (1045, \"Access denied for user 'root'@'localhost' (using password: NO)\")"} ``` It appears 4 times; for me set hostname, localhost, 127.0.0.1, and ::1 . I’ve even tried hardcoding my mysql\_root\_password in the mariadb task - but each time i get this error which specifies `using password: NO` … Its similar to a few old issues i’ve seen but none of the suggested fixed helped me. I’m new to the great roots pack - maybe im not getting something … I’ve tried sshing and apt-get removing the all mysql repos, and ran the playbook again, got the same error, and then tried `mysql -u root -p` to check - but my set password doesnt work. Any tip in the right direction would be greatly appreciated - it’s been hours . . . --- ## Post 2 by @swalkinshaw — 2016-03-07T21:10:12Z Did this error appear the very first time you tried to provision the server with `ansible-playbook server.yml -vvvv -e env=staging`? I know there’s been some issues when changing the password after a provision, but I haven’t heard of any on the first time. You could always try to kill and re-create the staging server and run the provision again. --- ## Post 3 by @daadir — 2016-03-07T21:30:32Z The first few times i had some other errors when i was still going through the missing bits of settings… So i am guessing the mariadb was built before it first got the users error. By kill and re-create you mean just scrape the whole vps and make a new one? [its not hard i just want to get your meaning] --- ## Post 4 by @swalkinshaw — 2016-03-07T21:35:13Z Yep that’s exactly what I mean. I’m hoping/assuming some of those others errors you encountered first messed up the state a little bit. So hopefully now that you’re settings all are correct doing it from scratch again should fix it. --- ## Post 5 by @daadir — 2016-03-07T21:59:06Z I’ll try that now. While running - why must i set `--ask-become-pass` if i am already setting a hashed password in vault.yml ? + i will verify soon, but in the previous machine, i skipped that after running with it a few times, and it was ok - is it saved somewhere? --- ## Post 6 by @daadir — 2016-03-07T22:00:51Z DANG. I hit that error again on a new server. I’ll try spinning up a newer new server. --- ## Post 7 by @fullyint — 2016-03-08T02:12:55Z > [@daadir](#): > > While running - why must i set --ask-become-pass if i am already setting a hashed password in vault.yml ? Here’s my understanding. Hope I got it right. The hashed password in `vault.yml` is loaded on the server. To escalate a non-root user’s privileges to run the playbook using sudo, you must enter a raw/unhashed password. The server makes [a cryptographic hash](https://en.wikipedia.org/wiki/Cryptographic_hash_function) of the submitted password and compares it to the hash previously loaded onto the server from `vault.yml`. With that background, you’ll understand that the hash in `vault.yml` is not the raw/unhashed password that must be entered in order to run sudo commands. Instead, you must manually enter this raw password each time your run `server.yml` to enable the `admin_user` to run tasks using sudo. It’s a little less painful when you know you can use the shortcut `-K` (uppercase K) instead of having to type `--ask-become-pass` This applies only if you have `sshd_permit_root_login: false` in `group_vars/all/security.yml` (which is a good setting for security :+1:). * * * I agree with @swalkinshaw: > [@swalkinshaw](#): > > I’m hoping/assuming some of those others errors you encountered first messed up the state a little bit. So hopefully now that you’re settings all are correct doing it from scratch again should fix it. Let us know what ends up being the fix. --- ## Post 8 by @daadir — 2016-03-08T07:30:38Z I ran the script on a fresh box, and finished fine! i destroyed that machine and will try again today as wordpress didnt actually install - im guessing it another wrong config i made. the DH part did take very long, a few minutes on 99.9% cpu And i understand the -K now, thanks! I actually didnt have `sshd_permit_root_login: false` but also didnt set up the public key correctly [named it `id_rsa.pub` instead of `authorized_keys` …] --- ## Post 9 by @fullyint — 2016-03-08T08:11:53Z > [@daadir](#): > > will try again today as wordpress didnt actually install - im guessing it another wrong config i made. Although `dev.yml` automatically installs WP on your dev machine, `server.yml` deliberately does not install WP: > [@Confusion on deploy](https://discourse.roots.io/t/confusion-on-deploy/5811/4): > > I think you’re confusing the terms _deploying_ and _installing_. Deploying a project basically means getting the code onto the server. Installing WordPress means creating a database and running their installer. > > The workflow for a brand new server is: > > 1. Provision server with `server.yml` > 2. Deploy site with `./deploy.sh` > 3. Install WordPress (however you want, just hit the URL to do it manually) > 4. Keep deploying as usual --- ## Post 10 by @daadir — 2016-03-08T23:20:15Z Thanks for the mention. Makes sense for the provision not to install WP. I’ll just say the docs mention the git repo is required for the trellis run - which i can say it isnt, not for the trellis provision run anyway. It’s just a bit confusing. Im now trying to get bedrock deployed, but having some trouble with the ssh keys. Using the roots/bedrock repo, im getting failed… ``` FAILED! => {"changed": false, "failed": true, "msg": "Git repo git@github.com:roots/bedrock.git cannot be accessed. Please verify the repository exists and you have SSH forwarding set up correctly.\nMore info:\n> https://roots.io/trellis/docs/deploys/#ssh-keys\n> https://roots.io/trellis/docs/ssh-keys/#cloning-remote-repo-using-ssh-agent-forwarding\n"} ``` Am i expected to fork the repo and add it as my own ? ++ Also, i am using the same username for `admin_user` and `web_user`, and so i replaced in `admin` in vault.yml with my own actual username --- ## Post 11 by @fullyint — 2016-03-09T00:17:37Z > [@daadir](#): > > I’ll just say the docs mention the git repo is required for the trellis run - which i can say it isnt, not for the trellis provision run anyway. It’s just a bit confusing. Reviewing the README and docs, I only found of the `repo` variable mentioned under a “Deploy” header or on the [Remote Server Setup](https://roots.io/trellis/docs/remote-server-setup/) page with the clarifier “required, used when deploying”. In any case, it would be rare to provision and not deploy because then you’d have a server but no site. I guess you could load up your site manually or using some non-Trellis deploy method. > [@daadir](#): > > Am i expected to fork the repo and add it as my own ? Yes, if you want to add any custom dependencies to the bedrock `composer.json` file (e.g., if you want any WP plugins, etc.). If the git clone error msg persists after switching `repo` to your fork, check out the SSH Keys docs’ discussion of [SSH agent forwarding](https://roots.io/trellis/docs/ssh-keys/#cloning-remote-repo-using-ssh-agent-forwarding) (mentioned in the error msg you posted). This thread has covered a variety of topics. If something new comes up, search discourse and the docs a bit, then go ahead and start a new thread, describing where you are in the debugging process. --- ## Post 12 by @fullyint — 2016-03-09T00:36:10Z > [@daadir](#): > > Also, i am using the same username for admin\_user and web\_user, and so i replaced in admin in vault.yml with my own actual username My understanding of this issue is a little hazy, but I’d recommend against having the `admin_user` and the `web_user` the same. The `web_user` owns and manages files in your web root and typically has limited privileges, for the sake of security. If you make `web_user` the same as `admin_user`, you’re giving `web_user` more privileges than necessary. There are some security implications I’d have to research to enumerate. One practical implication, however, is that if you work with a team, it is convenient to enable junior members to deploy as `web_user` but not change server configs, which would require running as `admin_user`. More discussion [here](https://github.com/roots/trellis/pull/58) and around discourse. It is _not_ a hassle to leave the defaults `admin_user: admin` and `web_user: web`. You just need your SSH keypair set up with the public key on the server and the private key on your local machine and the user stuff will take care of itself when running Trellis playbooks. I guess you’d have to remember to use `admin` or `web` when SSH-ing manually, but that’s not too much trouble. I’ve written way too much, but I’ll concede that if you’re the only one who will ever SSH in to the server to make changes with sudo, then it seems fine to set `admin_user` to your actual username. --- ## Post 14 by @daadir — 2016-03-10T18:10:38Z RIGHT. Thank you for all the help @fullyint . One semi-important side note, since we _did_ cover so many topics - after a successful deploy & install - i still found i was getting a 502 bad gateway error, for both of the 2 `site_hosts` set for my site. Digging for a minute in log files led me to restart php with `service php7.0-fpm restart` Here are the errors for reference: **/srv/www/logs/access.log** : ``` 1.2.3.4 - - [10/Mar/2016:19:20:18 +0200] "GET /index.php HTTP/1.1" 502 166 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0" ``` **/srv/www/logs/error.log** : ``` 2016/03/10 19:05:22 [crit] 31959#31959: *6 connect() to unix:/var/run/php-fpm-wordpress.sock failed (2: No such file or directory) while connecting to upstream, client: 1.2.3.4, server: domain.com, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm-wordpress.sock:", host: "domain.com" ``` **/var/log/php7.0-fpm.log** : ``` [10-Mar-2016 18:41:25] NOTICE: Reloading in progress ... [10-Mar-2016 18:41:25] NOTICE: reloading: execvp("/usr/sbin/php-fpm7.0", {"/usr/sbin/php-fpm7.0", "--daemonize", "--fpm-config", "/etc/php/7.0/fpm/php-fpm.conf"}) [10-Mar-2016 18:41:25] ERROR: [pool wordpress] the chdir path '/srv/www/' does not exist or is not a directory [10-Mar-2016 18:41:25] ERROR: [pool wordpress] the chdir path '/srv/www/' does not exist or is not a directory [10-Mar-2016 18:41:25] ERROR: failed to post process the configuration [10-Mar-2016 18:41:25] ERROR: failed to post process the configuration [10-Mar-2016 18:41:25] ERROR: FPM initialization failed [10-Mar-2016 18:41:25] ERROR: FPM initialization failed [10-Mar-2016 18:53:05] ERROR: [pool wordpress] the chdir path '/srv/www/' does not exist or is not a directory [10-Mar-2016 18:53:05] ERROR: failed to post process the configuration [10-Mar-2016 18:53:05] ERROR: FPM initialization failed [10-Mar-2016 18:53:05] ERROR: [pool wordpress] the chdir path '/srv/www/' does not exist or is not a directory [10-Mar-2016 18:53:05] ERROR: failed to post process the configuration [10-Mar-2016 18:53:05] ERROR: FPM initialization failed ``` after php restart : ``` [10-Mar-2016 19:23:12] NOTICE: fpm is running, pid 1486 [10-Mar-2016 19:23:12] NOTICE: ready to handle connections [10-Mar-2016 19:23:12] NOTICE: systemd monitor interval set to 10000ms ``` THX a 10\*8sideways !