# Initial mysql root user setup **URL:** \ **Category:** Ansible Project\ **Created:** [February 24, 2013, 8:03pm UTC](https://forum.ansible.com/t/initial-mysql-root-user-setup/12417 "2013-02-24T20:03:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\ **Post date:** [February 24, 2013, 8:03pm UTC](https://forum.ansible.com/t/initial-mysql-root-user-setup/12417/1 "2013-02-24T20:03:32Z")
When you install a myql server package you typically end up with a root user without a password. As a way of dealing with this in a indempotent way I was thinking of extending the mysql\_user module to add a boolean option, say fix\_unpassworded\_root\_user, which if set:-    - throws an error if login\_user is not root or login\_password      is not set    - throws an error if user or password parameters are set - this only      does one thing    - attempts to authenticate with the given login\_user/login\_password      returns ok (unchanged) if works    - attempts to authenticate with root/empty password and returns      failed if that does not work    - sets the root password to the supplied login\_password, returns      ok (changed) if works I think it may be possible to do this with a hacked around pair of mysql\_user calls (the first ignoring failure, the second being there to check the root password is correctly set), but I think extending the module for this special case may make things clearer at the cost of additional internal complexity... Or do others disagree?   Nigel. ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [February 24, 2013, 8:26pm UTC](https://forum.ansible.com/t/initial-mysql-root-user-setup/12417/2 "2013-02-24T20:26:47Z")
> When you install a myql server package you typically end up with a root user > without a password. > > As a way of dealing with this in a indempotent way I was thinking of > extending the mysql\_user module to add a boolean option, say > fix\_unpassworded\_root\_user, which if set:- >   - throws an error if login\_user is not root or login\_password >     is not set >   - throws an error if user or password parameters are set - this only >     does one thing >   - attempts to authenticate with the given login\_user/login\_password >     returns ok (unchanged) if works >   - attempts to authenticate with root/empty password and returns >     failed if that does not work >   - sets the root password to the supplied login\_password, returns >     ok (changed) if works' This seems to be a confusing option to me. ---
**Author:** ![Mark\_Theunissen](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@Mark\_Theunissen](https://forum.ansible.com/u/Mark_Theunissen)\ **Post date:** [February 28, 2013, 4:27pm UTC](https://forum.ansible.com/t/initial-mysql-root-user-setup/12417/3 "2013-02-28T16:27:02Z")
Hi Nigel, To deal with MySQL root user in an idempotent way, I use the following: - name: MySQL | Set the root password. action: mysql\_user user=root password=$mysql\_root\_password host=localhost - name: MySQL | Drop the credentials file so that this playbook can run again. action: template src=templates/root-my-cnf.j2 dest=/root/.my.cnf The first time this playbook is run, the login\_user and login\_password are root/(empty), so task #1 succeeds. The second task drops the credentials in the root user’s home directory. On subsequent runs of the playbook, Ansible will discover the credentials file containing the login\_user and login\_password in task #1, and authenticate successfully as root, and the run through will be idempotent. I have added a pull request to put this in the documentation, as it is perhaps a little non-obvious. [https://github.com/ansible/ansible/pull/2235/files](https://github.com/ansible/ansible/pull/2235/files) - Mark ---
**Author:** ![Mark\_Theunissen](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@Mark\_Theunissen](https://forum.ansible.com/u/Mark_Theunissen)\ **Post date:** [February 28, 2013, 4:41pm UTC](https://forum.ansible.com/t/initial-mysql-root-user-setup/12417/4 "2013-02-28T16:41:39Z")
It may be a good idea for future development to provide a ‘credentials\_file’ argument to the mysql\_\* modules, containing the path to the credentials file, but since the MySQL client itself uses ~/.my.cnf natively, that’s what we went for in creating the module.