starred/modoboa-modoboa

Fork 0

mirror of https://github.com/modoboa/modoboa.git synced 2026-04-25 17:06:01 +03:00

[GH-ISSUE #1477] Annoing warning in error log with mysql DB #1163

New issue

Closed

opened 2026-02-27 11:15:38 +03:00 by kerem · 6 comments

kerem commented

2026-02-27 11:15:38 +03:00

Owner

Originally created by @niko-lay on GitHub (Apr 25, 2018).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1477

Impacted versions

Modoboa: 1.10.4
installer used: Yes
Webserver: Nginx

Steps to reproduce

Install modoboa with mysql, not mariadb. Set in installer.cfg

[database]
engine = mysql
host = 127.0.0.1
install = false

and provide root credentials

Current behavior

Each request to the database is accompanied with an annoying message in the logs
Apr 22 09:59:17 xxx dovecot: postlogin: Error: mysql: [Warning] Using a password on the command line interface can be insecure.

Expected behavior

No message about mysql error/warning

Is there any ability to remove this message? For example, I want to use mysql_config_editor, but I'm not sure if the proxy:mysql understands this setting

Originally created by @niko-lay on GitHub (Apr 25, 2018). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1477 # Impacted versions * Modoboa: 1.10.4 * installer used: Yes * Webserver: Nginx # Steps to reproduce Install modoboa with mysql, not mariadb. Set in installer.cfg ``` [database] engine = mysql host = 127.0.0.1 install = false ``` and provide root credentials # Current behavior Each request to the database is accompanied with an annoying message in the logs ` Apr 22 09:59:17 xxx dovecot: postlogin: Error: mysql: [Warning] Using a password on the command line interface can be insecure. ` # Expected behavior No message about mysql error/warning Is there any ability to remove this message? For example, I want to use `mysql_config_editor`, but I'm not sure if the `proxy:mysql` understands this setting

kerem

2026-02-27 11:15:38 +03:00

closed this issue
added the
stale
label

kerem commented

2026-02-27 11:15:38 +03:00

Author

Owner

@tomcrus001 commented on GitHub (Oct 31, 2020):

Hey there.

As the databse-credentials are already contained in Modoboa's configuration file settings.py, I'd suggest to add another command to manage.py e.g. update-last-login, which will do the database-query in turn.

This way the shell-script postlogin.sh currently being in charge of doing this isn't needed any more and therefor doesn't need to contain any username/password for accessing the database.

I'd also be willing to contribute this myself. I have some experience with Django, but as I just started using Modoboa I'm not sure what would be the best Django-app to include this, maybe the admin-app?

@tomcrus001 commented on GitHub (Oct 31, 2020): Hey there. As the databse-credentials are already contained in *Modoboa*'s configuration file `settings.py`, I'd suggest to add another command to `manage.py` e.g. `update-last-login`, which will do the database-query in turn. This way the shell-script `postlogin.sh` currently being in charge of doing this isn't needed any more and therefor doesn't need to contain any username/password for accessing the database. I'd also be willing to contribute this myself. I have some experience with *Django*, but as I just started using *Modoboa* I'm not sure what would be the best *Django*-app to include this, maybe the `admin`-app?

kerem commented

2026-02-27 11:15:38 +03:00

Author

Owner

@tomcrus001 commented on GitHub (Oct 31, 2020):

Some background information about the warning itself can be found here: End-User Guidelines for Password Security

In short the: password given to mysql (or also any other DB-cli-tool) as command-line-parameter can possibly get seen by anybody who can see the process-list on the server. So this is a security-risk of leaking the database-password!

@tomcrus001 commented on GitHub (Oct 31, 2020): Some background information about the warning itself can be found here: [End-User Guidelines for Password Security](https://dev.mysql.com/doc/refman/8.0/en/password-security-user.html) In short the: password given to `mysql` (or also any other DB-cli-tool) as command-line-parameter can possibly get seen by anybody who can see the process-list on the server. So this is a security-risk of leaking the database-password!

kerem commented

2026-02-27 11:15:38 +03:00

Author

Owner

@tonioo commented on GitHub (Nov 5, 2020):

@tomcrus001 That's actually a good idea! I think the core app would be the best place, since it contains the User model. What do you think?

@tonioo commented on GitHub (Nov 5, 2020): @tomcrus001 That's actually a good idea! I think the core app would be the best place, since it contains the User model. What do you think?

kerem commented

2026-02-27 11:15:38 +03:00

Author

Owner

@tomcrus001 commented on GitHub (Jan 8, 2021):

Just for convenience I'll document some background-information about where the mentioned postlogin.sh gets used and for what purpose:
The dovecot-configuration in /etc/dovecot/conf.d/10-master.conf specifies to call this script after login to imap-/pop3-services - see Dovecot-Documantation about this.
The script just updates the timestamp of last user-login and get executed as modoboa-user

@tomcrus001 commented on GitHub (Jan 8, 2021): Just for convenience I'll document some background-information about where the mentioned `postlogin.sh` gets used and for what purpose: The *dovecot*-configuration in `/etc/dovecot/conf.d/10-master.conf` specifies to call this script after login to *imap*-/*pop3*-services - see [Dovecot-Documantation](https://wiki.dovecot.org/PostLoginScripting) about this. The script just updates the timestamp of last user-login and get executed as *modoboa*-user

kerem commented

2026-02-27 11:15:38 +03:00

Author

Owner

@tomcrus001 commented on GitHub (Jan 8, 2021):

I'll try now to implement this function as management-command as suggested before and make a pull-request as soon as I have implemented it.
After that there still exists the need to also change the modoboa-installer to use this new command instead postlogin.sh.
And probably there needs to get done some updates on already installed setups as well. Are there any update-scripts that get used for this?

@tomcrus001 commented on GitHub (Jan 8, 2021): I'll try now to implement this function as management-command as suggested before and make a pull-request as soon as I have implemented it. After that there still exists the need to also change the modoboa-installer to use this new command instead `postlogin.sh`. And probably there needs to get done some updates on already installed setups as well. Are there any update-scripts that get used for this?

kerem commented

2026-02-27 11:15:38 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 21, 2026):

This issue was closed because it has been stalled for 14 days with no activity.

@github-actions[bot] commented on GitHub (Jan 21, 2026): This issue was closed because it has been stalled for 14 days with no activity.

kerem referenced this issue

2026-02-27 12:09:35 +03:00

[PR #1163] [MERGED] [admin] fixed retrieve account endpoint. #2141