125 Comments

1. Davide / November 30, 2011

   Great tutorial (like all the others on your site).

   Thanks Davide

   Reply
2. Roman / November 30, 2011

   Thank you, JR

   Httpd start normally.

   audit.log -> http://www.sendspace.com/file/vlq3wk

   [root@rrom-notebook rrom]# grep mysql /var/log/audit/audit.log > audit.log
   [root@rrom-notebook rrom]#
   [root@rrom-notebook rrom]# wc -l /var/log/audit/audit.log
   19300 /var/log/audit/audit.log
   [root@rrom-notebook rrom]# ^C
   [root@rrom-notebook rrom]#

   Reply
   • JR / November 30, 2011

     Hi Roman,

     Still sounds some SELinux problem, but I’m not sure is your auditd service running, please could you post also output of following command:

     systemctl status auditd.service
     

     Do you run MySQL just with default setup?

     Reply
     • JR / November 30, 2011

       I just noticed that the selinux-policy-3.10.0-61 and selinux-policy-targeted-3.10.0-61 is released, so try update your system and try to start mysql service again…?

       Reply
3. Roman / December 1, 2011

   [rrom@rrom-notebook ~]$ systemctl status auditd.service
   auditd.service – Security Auditing Service
   Loaded: loaded (/lib/systemd/system/auditd.service; enabled)
   Active: active (running) since Thu, 01 Dec 2011 10:56:07 +0300; 19min ago
   Process: 1065 ExecStartPost=/sbin/auditctl -R /etc/audit/audit.rules (code=exited, status=0/SUCCESS)
   Main PID: 1059 (auditd)
   CGroup: name=systemd:/system/auditd.service
   ├ 1059 /sbin/auditd -n
   ├ 1098 /sbin/audispd
   └ 1099 /usr/sbin/sedispatch
   [rrom@rrom-notebook ~]$

   I update system to selinux-policy-3.10.0-61 and selinux-policy-targeted-3.10.0-61, but:

   [rrom@rrom-notebook ~]$ sudo service mysqld start
   [sudo] password for rrom:
   Redirecting to /bin/systemctl start mysqld.service
   Job failed. See system logs and ‘systemctl status’ for details.
   [rrom@rrom-notebook ~]$

   Reply
4. Roman / December 1, 2011

   [rrom@rrom-notebook ~]$ su
   Password:
   [root@rrom-notebook rrom]# grep mysqld_safe /var/log/audit/audit.log | audit2allow -M mysqlpol
   compilation failed:
   mysqlpol.te:6:ERROR ‘syntax error’ at token ” on line 6:

   /usr/bin/checkmodule: error(s) encountered while parsing configuration
   /usr/bin/checkmodule: loading policy configuration from mysqlpol.te
   [root@rrom-notebook rrom]# semodule -i mysqlpol.pp
   semodule: Failed on mysqlpol.pp!
   [root@rrom-notebook rrom]#

   Reply
5. JR / December 1, 2011

   Hi Roman,

   Okey, I have to believe that it’s not SELinux problem. :) And yes audit2allow fails because your grep command grep mysqld_safe /var/log/audit/audit.log output is just empty.

   So this is some totally new problem. I actually do some tests with just installed Fedora 16 and installed mysql and mysql-server packages and it’s starts normally, so this is very strange, but next I have to ask more information from you… :) Let’s check following things next, could you post following log file here (So I assume that you are using the default mysqld log file):

   /var/log/mysqld.log
   

   And then try following:

   ## Change root ##
   su -
   
   ## Change mysql user ##
   su mysql
   
   ## Run following long command ##
   ## 32-bit system ##
   /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib/mysql/plugin --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock
   
   ## 64-bit system
   /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock
   

   This is exactly same command what systemctl tries to run. Do you get any errors here or is it failing?

   Reply
6. Artur / December 5, 2011

   Hi, I got the error:
   ‘Job failed. See system logs and ‘systemctl status’ for details.’

   After execute the command: ‘systemctl start mysqld.service’

   And then I executed: ‘grep mysqld_safe /var/log/audit/audit.log | audit2allow -M mysqlpol’

   But got the error:

   compilation failed:
   mysqlpol.te:6:ERROR ‘syntax error’ at token ” on line 6:

   /usr/bin/checkmodule: error(s) encountered while parsing configuration
   /usr/bin/checkmodule: loading policy configuration from mysqlpol.te

   I Search a lot on net, but don’t found anything! Could you help me JR?

   p.s.: Sorry for my bad english

   Reply
7. Artur / December 5, 2011

   So, I Execute these commands:

   su -

   ## Change mysql user ##
   su mysql

   ## Run following long command ##

   ## 64-bit system
   /usr/libexec/mysqld –basedir=/usr –datadir=/var/lib/mysql –plugin-dir=/usr/lib64/mysql/plugin –log-error=/var/log/mysqld.log –pid-file=/var/run/mysqld/mysqld.pid –socket=/var/lib/mysql/mysql.sock

   And get no output…

   Reply
   • JR / December 5, 2011

     Okey, you don’t get output, but is your MySQL server working then? :)

     Open another console and write:

     mysql
     

     Reply
     • Artur / December 5, 2011

       I got this:

       ERROR 2002 (HY000): Can’t connect to local MySQL server through socket ‘/var/lib/mysql/mysql.sock’ (2)

       And my version of SELinux-policy is:

       selinux-policy.noarch 3.10.0-64.fc16

       Reply
       • JR / December 6, 2011

         Hi Artur,

         Could you post your /var/log/mysqld.log log file here?

         Reply
         • Artur / December 6, 2011

           111205 22:02:12 [ERROR] Can't open the mysql.plugin table. Please run mysql_upgrade to create it.
           111205 22:02:12 InnoDB: The InnoDB memory heap is disabled
           111205 22:02:12 InnoDB: Mutexes and rw_locks use GCC atomic builtins
           111205 22:02:12 InnoDB: Compressed tables use zlib 1.2.5
           111205 22:02:12 InnoDB: Using Linux native AIO
           111205 22:02:12 InnoDB: Initializing buffer pool, size = 128.0M
           111205 22:02:12 InnoDB: Completed initialization of buffer pool
           111205 22:02:12 InnoDB: highest supported file format is Barracuda.
           111205 22:02:13  InnoDB: Waiting for the background threads to start
           111205 22:02:14 InnoDB: 1.1.8 started; log sequence number 1595675
           111205 22:02:14 [ERROR] /usr/libexec/mysqld: Can't find file: './mysql/host.frm' (errno: 13)
           111205 22:02:14 [ERROR] Fatal error: Can't open and lock privilege tables: Can't find file: './mysql/host.frm' (errno: 13)
           111205 22:02:15 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
           111205 22:02:15 [Note] Plugin 'FEDERATED' is disabled.
           /usr/libexec/mysqld: Can't find file: './mysql/plugin.frm' (errno: 13)
           111205 22:02:15 [ERROR] Can't open the mysql.plugin table. Please run mysql_upgrade to create it.
           111205 22:02:15 InnoDB: The InnoDB memory heap is disabled
           111205 22:02:15 InnoDB: Mutexes and rw_locks use GCC atomic builtins
           111205 22:02:15 InnoDB: Compressed tables use zlib 1.2.5
           111205 22:02:15 InnoDB: Using Linux native AIO
           111205 22:02:15 InnoDB: Initializing buffer pool, size = 128.0M
           111205 22:02:15 InnoDB: Completed initialization of buffer pool
           111205 22:02:15 InnoDB: highest supported file format is Barracuda.
           111205 22:02:15  InnoDB: Waiting for the background threads to start
           111205 22:02:16 InnoDB: 1.1.8 started; log sequence number 1595675
           111205 22:02:16 [ERROR] /usr/libexec/mysqld: Can't find file: './mysql/host.frm' (errno: 13)
           111205 22:02:16 [ERROR] Fatal error: Can't open and lock privilege tables: Can't find file: './mysql/host.frm' (errno: 13)
           111205 22:02:17 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
           111205 22:02:17 [Note] Plugin 'FEDERATED' is disabled.
           /usr/libexec/mysqld: Can't find file: './mysql/plugin.frm' (errno: 13)
           111205 22:02:17 [ERROR] Can't open the mysql.plugin table. Please run mysql_upgrade to create it.
           111205 22:02:17 InnoDB: The InnoDB memory heap is disabled
           111205 22:02:17 InnoDB: Mutexes and rw_locks use GCC atomic builtins
           111205 22:02:17 InnoDB: Compressed tables use zlib 1.2.5
           111205 22:02:17 InnoDB: Using Linux native AIO
           111205 22:02:17 InnoDB: Initializing buffer pool, size = 128.0M
           111205 22:02:17 InnoDB: Completed initialization of buffer pool
           111205 22:02:17 InnoDB: highest supported file format is Barracuda.
           111205 22:02:17  InnoDB: Waiting for the background threads to start
           

           I post only these, because the file is too long but these sets of errors are repeated.

           Reply
           • JR / December 6, 2011

             Thanks Artur,

             Try to run:

             mysql_upgrade
             

             And please post output of following commands:

             ls -la /usr/lib/mysql
             
             ls -la /var/lib/mysql/mysql/ |grep -e host -e plugin
             

             Reply
             • Artur / December 6, 2011

               root@artur artur# mysql_upgrade
               Looking for ‘mysql’ as: mysql
               Looking for ‘mysqlcheck’ as: mysqlcheck
               Running ‘mysqlcheck with default connection arguments
               mysqlcheck: Got error: 2002: Can’t connect to local MySQL server through socket ‘/var/lib/mysql/mysql.sock’ (2) when trying to connect
               FATAL ERROR: Upgrade failed
               root@artur artur# ls -la /usr/lib/mysql
               ls: impossível acessar /usr/lib/mysql: Arquivo ou diretório não encontrado
               root@artur artur# ls -la /var/lib/mysql/mysql/ |grep -e host -e plugin
               -rw-rw—-. 1 root root 9510 Dez 4 20:01 host.frm
               -rw-rw—-. 1 root root 0 Dez 4 20:01 host.MYD
               -rw-rw—-. 1 root root 2048 Dez 4 20:01 host.MYI
               -rw-rw—-. 1 root root 8586 Dez 4 20:01 plugin.frm
               -rw-rw—-. 1 root root 0 Dez 4 20:01 plugin.MYD
               -rw-rw—-. 1 root root 1024 Dez 4 20:01 plugin.MYI

               Reply
               • JR / December 6, 2011

                 Now I see your problem, you have (at least) wrong permissions on /usr/lib/mysql/mysql directory. And sorry I ask you ls output from wrong directory, so could you post also output of following commands:

                 ls -la /var/lib/ |grep mysql
                 
                 ls -la /var/lib/mysql
                 

                 Reply
                 • Artur / December 6, 2011

                   No problem! You helps me so much…Of course I won’t reclaim hehehe.

                   The Outputs:

                   root@artur artur# ls -la /var/lib/ |grep mysql
                   drwxr-xr-x. 5 mysql mysql 4096 Dez 6 17:00 mysql
                   root@artur artur# ls -la /var/lib/mysql
                   total 28696
                   drwxr-xr-x. 5 mysql mysql 4096 Dez 6 17:00 .
                   drwxr-xr-x. 43 root root 4096 Dez 4 19:41 ..
                   -rw——-. 1 mysql mysql 402 Dez 4 23:11 .bash_history
                   -rw-rw—-. 1 mysql mysql 18874368 Dez 4 21:01 ibdata1
                   -rw-rw—-. 1 mysql mysql 5242880 Dez 6 17:00 ib_logfile0
                   -rw-rw—-. 1 mysql mysql 5242880 Dez 4 20:03 ib_logfile1
                   drwx——. 2 root root 4096 Dez 4 20:01 mysql
                   drwx——. 2 root root 4096 Dez 4 20:01 performance_schema
                   drwx——. 2 root root 4096 Dez 4 20:01 test
                   root@artur artur#

                   Reply
                   • JR / December 6, 2011

                     Thanks! :)

                     Some reason your permissions are changed from mysql:mysql to root:root, so try following (as root):

                     ## Change directory to /var/lib/mysql ##
                     cd /var/lib/mysql/
                     
                     ## Change directories permissions recursively ##
                     chown -R mysql:mysql mysql/ performance_schema/ test/
                     
                     ## Try to start mysqld again ##
                     systemctl start mysqld.service
                     
8. Artur / December 7, 2011

   It’s works! You are a linux developer or something like this? :0 Well who you understand the last output? I say, to know exataly the problem?
   And how you came to suspect that the problem was access permission?

   Thanks a lot! I am very young on linux and on fedora much more.

   Reply
   • JR / December 7, 2011

     Excellent to hear that your MySQL is working… :)

     I’m not Linux developer :) But I have used Linux very long time (about 12 years now), I’m also sysadmin, database admin and developer… :)

     Your last output tells about some strange problem with your /var/lib/mysql/ directory permission, just checked my own installations and look what permissions should be when MySQL working normally (I think that some Fedora 16 MySQL update is messed those permissions, because normally MySQL is working out of the box). Actually your MySQL error log shows something interesting when mysqld try to start it doesn’t found /mysql/host.frm and /mysql/plugin.frm files which should exists, that’s why I wanted to see do have those files and what are those files permissions. ;)

     You are very welcome! And it’s always nice to see new Linux users and if you have some problems which are not related to any guides, feel free to join if !1 0 forums and ask your questions. :)

     Reply
     • Artur / December 8, 2011

       Joined!

       Reply
       • JR / December 8, 2011

         Cool! :)

         Reply
9. Virender / December 14, 2011

   thanks for such a wonderfull help in vein. It helps me lot and now I am running my mysql

   Reply
10. Kevin Cheathem / December 26, 2011

    When I go to /etc/sysconfig/iptables, there is nothing there. I am using CentOS 6. What can I do to correct this?

    Reply
11. Kevin Cheathem / December 27, 2011

    I found the error in my ways…lol

    Thanks for the awesome tutorial

    Reply
12. Harshal / January 10, 2012

    Thanks a lot for the comprehensive list :). It was very helpful.

    Reply
13. Mikko / January 16, 2012

    Hi JR,

    just a quick question:

    If I would like to run WordPress only from local host, with no intention to access the data from any other computer, do I still need to follow the part

    Enable Remote Connection to MySQL Server –> Open MySQL Port (3306) on Iptables Firewall (as root user again) ?

    Thanks in advance!

    -Mikko

    Reply
    • JR / January 17, 2012

      Hi Mikko,

      First of all, really nice to hear that you got MySQL working! :)

      And yes, if you want use only local connections, then do not open MySQL port 3306. :)

      In any case might be better not open MySQL port to the public network. This part of guide is mainly/normally intended for LAN usage, where all (database) servers are behind firewalls, load balancers and so on… :)

      Reply
14. Benjamin White / January 20, 2012

    Hi JR.

    This site is ridiculously helpful.

    I’m having some problems that appear to be similar to but distinct from those that Roman described. I’m able to get almost done with all of step 5, but then when i try this command

    grep mysqld_safe /var/log/audit/audit.log | audit2allow -M mysqlpol

    i get the following

    -bash: audit2allow: command not found

    any idea what i’m up against here?

    your help is much appreciated.

    Ben

    Reply
    • JR / January 20, 2012

      Hi Benjamin,

      Thanks! :D

      First, do you get following error when you try to start mysqld?

      Job failed. See system logs and 'systemctl status' for details.
      

      Reply
15. Rizvan / February 6, 2012

    Hi,
    after following your steps i got this error :
    ERROR 2003 (HY000): Can’t connect to MySQL server on ’10.0.15.25′ (110)
    Can u suggest me about this ?

    My PC ENVIRONMENT : FEDORA 13 ,Apache installed ,mysql 5.5.20
    I have doubt this remote_ip .. Please explain about it..

    Thank u ..

    Reply
    • JR / February 6, 2012

      Hi Rizvan,

      This REMOTE_IP 10.0.15.25, is just a hypothetical example, you have to use of course your own remote ip(s) or localhost or some other address.

      Reply