*** Please type your report below this line ***

The rsyslog documentation states the following (in
/usr/share/doc/rsyslog-doc/html/rsyslog_mysql.html):


If you have modified the default, use your name here. Database-userid and
-password are the credentials used to connect to the database. As they are
stored in clear text in rsyslog.conf, that user should have only the least
possible privileges. It is sufficient to grant it INSERT privileges to the
systemevents table, only.


However, when I look at the permissions in MySQL, I see:

mysql> show grants for rsyslog@localhost;
+----------------------------------------------------------------------------------------------------------------+
| Grants for rsyslog@localhost
|
+----------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'rsyslog'@'localhost' IDENTIFIED BY PASSWORD
'*blahblahpasswordremoved' |
| GRANT ALL PRIVILEGES ON `Syslog`.* TO 'rsyslog'@'localhost'
|
+----------------------------------------------------------------------------------------------------------------+

I would prefer giving INSERT privileges to this user (or another called
rsyslog_logger) and then if necessary having a saparate user which can
do selects on the database.

- Paul

reassign 534258 dbconfig-common
severity 534258 wishlist
thanks

Paul Nijjar wrote:

..

Hi Paul,

rsyslog uses dbconfig-common for configuring mysql/postgresql databases. So I
think this bug should be handled within the dbconfig-common package, reassigning.

Cheers,
Michael

[I am reviewing bugs assigned to dbconfig-common, hence my question here.]
option to set the privileges? Of course you can't blame dbconfig-common
for the extensive privileges of the rsyslog user as there is no way for
dbconfig-common to know why privileges are appropriate for any package.

My proposal is to clone this bug back and retitle this bug to:
dbconfig-common: should allow database user privileges to be configurable

Paul