Avoid root password leak to process list

diff --git a/templates/setmysqlpass.sh.erb b/templates/setmysqlpass.sh.erb
index fbca07e28121e47a1eed317a1436410b99c371d1..1cc34dbe760a29e9d0d219e8ca58ad67760726e2 100644 (file)
--- a/templates/setmysqlpass.sh.erb
+++ b/templates/setmysqlpass.sh.erb
@@ -8,5 +8,7 @@ PASSWORD="<%= mysql_rootpw %>"
 DEFAULTS="/etc/mysql/debian.cnf"
 
 # Run
-echo "USE mysql; UPDATE user SET Password=PASSWORD('$PASSWORD') WHERE User='root' AND Host='localhost'; flush privileges;" | \
-  /usr/bin/mysql --defaults-file=$DEFAULTS
+/usr/bin/mysql --defaults-file=$DEFAULTS <<EOF
+UPDATE mysql.user SET Password=PASSWORD('$PASSWORD') WHERE User='root' AND Host='localhost';
+FLUSH PRIVILEGES;
+EOF