MariaDB: ensure client no-SSL (ssl=0, skip-ssl) on all installs - fix ERROR 2026

2026-02-19 13:06:48 +01:00 · 2026-02-17 00:00:28 +01:00
parent 5f6ca0d379
commit a42e2ffab0
4 changed files with 69 additions and 18 deletions
--- a/cyberpanel_upgrade_monolithic.sh
+++ b/cyberpanel_upgrade_monolithic.sh
@@ -794,6 +794,7 @@ EOF
    dnf clean metadata --disablerepo='*' --enablerepo=mariadb 2>/dev/null || true
    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade
    MARIADB_OLD_10=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10" ]] && MARIADB_OLD_10=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    # Also detect 11.x by package version (e.g. MariaDB-server-11.8.6-1.el9)
    [[ -z "$MARIADB_OLD_11" ]] && MARIADB_OLD_11=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
@@ -807,7 +808,7 @@ EOF
      rpm -e "$MARIADB_OLD_10" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -821,7 +822,7 @@ EOF
      rpm -e "$MARIADB_OLD_11" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -844,7 +845,7 @@ EOF
          rpm -e "$STILL_11" --nodeps 2>/dev/null || true
          dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
          mkdir -p /etc/my.cnf.d
-          printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+          printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
          systemctl start mariadb 2>/dev/null || true
          sleep 2
          mariadb-upgrade -u root 2>/dev/null || true
@@ -854,7 +855,11 @@ EOF
    fi
    # Allow local client to connect without SSL (11.x client defaults to SSL; 10.x server may not have it)
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    # Ensure main my.cnf has [client] without SSL when server has SSL disabled (ERROR 2026 fix)
+    if [[ -f /etc/my.cnf ]] && ! grep -q '^\[client\]' /etc/my.cnf 2>/dev/null; then
+      echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf
+    fi
    # Optional: migrate from latin1 to UTF-8 (utf8mb4) when --migrate-to-utf8 and 11.x/12.x
    if [[ "$Migrate_MariaDB_To_UTF8_Requested" = "yes" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
      Migrate_MariaDB_To_UTF8
@@ -879,6 +884,7 @@ EOF
    
    # Install/upgrade MariaDB from our repo (any version: 10.11, 11.8, 12.x). Manual path for 10->11 and 11->12.
    MARIADB_OLD_10_AL9=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10_AL9" ]] && MARIADB_OLD_10_AL9=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    [[ -z "$MARIADB_OLD_11_AL9" ]] && MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
    if [[ -n "$MARIADB_OLD_10_AL9" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
@@ -890,7 +896,7 @@ EOF
      rpm -e "$MARIADB_OLD_10_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -904,7 +910,7 @@ EOF
      rpm -e "$MARIADB_OLD_11_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -916,7 +922,7 @@ EOF
    fi
    # Allow local client to connect without SSL
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true

    # Install additional required packages (omit curl - AlmaLinux 9 has curl-minimal, avoid conflict)
    dnf install -y wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel 2>/dev/null || dnf install -y --allowerasing wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel
@@ -1354,6 +1360,13 @@ echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Running: $CP_PYTHON upgrade.py $Branch_N

 # Export Git user so upgrade.py clones from the same repo (master3395 or --repo override)
 export CYBERPANEL_GIT_USER="${Git_User:-usmannasir}"
+# So upgrade.py can import plogical (it runs from /root/cyberpanel_upgrade_tmp)
+export PYTHONPATH="/usr/local/CyberCP${PYTHONPATH:+:$PYTHONPATH}"
+
+# Run from dir that contains upgrade.py
+for d in /root/cyberpanel_upgrade_tmp /usr/local/CyberCP; do
+  if [[ -f "$d/upgrade.py" ]]; then cd "$d" || true; break; fi
+done

 # Run upgrade.py and capture output
 upgrade_output=$("$CP_PYTHON" upgrade.py "$Branch_Name" 2>&1)
@@ -1421,7 +1434,8 @@ elif [[ "$Server_OS" = "openEuler" ]] ; then
 fi

 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Running fallback: /usr/local/CyberPanelTemp/bin/python upgrade.py $Branch_Name" | tee -a /var/log/cyberpanel_upgrade_debug.log
-export CYBERPANEL_GIT_USER="${Git_User:-master3395}"
+export CYBERPANEL_GIT_USER="${Git_User:-usmannasir}"
+export PYTHONPATH="/usr/local/CyberCP${PYTHONPATH:+:$PYTHONPATH}"
 /usr/local/CyberPanelTemp/bin/python upgrade.py "$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
 FALLBACK_CODE=$?
 echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Fallback upgrade returned code: $FALLBACK_CODE" | tee -a /var/log/cyberpanel_upgrade_debug.log
@@ -1682,7 +1696,8 @@ Sync_CyberCP_To_Latest() {
    cd /usr/local/CyberCP
    git fetch origin 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
    if git show-ref -q "refs/remotes/origin/$Branch_Name"; then
-      git checkout -B "$Branch_Name" "origin/$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
+      # Force tree to match remote so local changes/untracked files do not block (settings.py restored below)
+      git reset --hard "origin/$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log
    else
      git checkout "$Branch_Name" 2>/dev/null || true
      git pull --ff-only origin "$Branch_Name" 2>&1 | tee -a /var/log/cyberpanel_upgrade_debug.log || true
--- a/install/install.py
+++ b/install/install.py
@@ -2149,6 +2149,27 @@ module cyberpanel_ols {
            logging.InstallLog.writeToFile(error_msg)
            raise Exception(error_msg)

+    def _ensure_mariadb_client_no_ssl(self):
+        """Ensure MariaDB client connects without SSL (avoids ERROR 2026 when server has have_ssl=DISABLED)."""
+        client_cnf = "[client]\nssl=0\nskip-ssl\n"
+        try:
+            # RHEL/AlmaLinux: /etc/my.cnf.d/cyberpanel-client.cnf
+            if not os.path.exists('/etc/my.cnf.d'):
+                os.makedirs('/etc/my.cnf.d', mode=0o755, exist_ok=True)
+            with open('/etc/my.cnf.d/cyberpanel-client.cnf', 'w') as f:
+                f.write(client_cnf)
+            logging.InstallLog.writeToFile("Created /etc/my.cnf.d/cyberpanel-client.cnf (client SSL disabled)")
+        except Exception as e:
+            logging.InstallLog.writeToFile("_ensure_mariadb_client_no_ssl: /etc/my.cnf.d: %s" % str(e))
+        try:
+            # Debian/Ubuntu: /etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf
+            if os.path.exists('/etc/mysql/mariadb.conf.d'):
+                with open('/etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf', 'w') as f:
+                    f.write(client_cnf)
+                logging.InstallLog.writeToFile("Created /etc/mysql/mariadb.conf.d/99-cyberpanel-client.cnf (client SSL disabled)")
+        except Exception as e:
+            logging.InstallLog.writeToFile("_ensure_mariadb_client_no_ssl: mariadb.conf.d: %s" % str(e))
+
    def command_exists(self, command):
        """Check if a command exists in PATH"""
        try:
@@ -3225,10 +3246,13 @@ module cyberpanel_ols {
        # all the other control panels allow
        # reference: https://oracle-base.com/articles/mysql/mysql-password-less-logins-using-option-files
        mysql_my_root_cnf = '/root/.my.cnf'
+        # Include skip-ssl/ssl=0 so client does not require SSL (avoids ERROR 2026 when server has have_ssl=DISABLED)
        mysql_root_cnf_content = """
 [client]
 user=root
 password="%s"
+ssl=0
+skip-ssl
 """ % password

        with open(mysql_my_root_cnf, 'w') as f:
@@ -3239,6 +3263,10 @@ password="%s"

        logging.InstallLog.writeToFile("Updating /root/.my.cnf!")

+        # Ensure system-wide MariaDB client uses no SSL (all installs: avoids ERROR 2026 on servers with SSL disabled)
+        if self.remotemysql == 'OFF':
+            self._ensure_mariadb_client_no_ssl()
+
        logging.InstallLog.writeToFile("Generating secure environment configuration!")

        # Determine the correct MySQL root password to use
--- a/to-do/fix-phpmyadmin-mariadb-version-on-server.md
+++ b/to-do/fix-phpmyadmin-mariadb-version-on-server.md
@@ -5,9 +5,11 @@
 Run as root on the server:

 ```bash
-# Allow mariadb client to connect without SSL (11.x client requires SSL by default)
+# Allow mariadb client to connect without SSL (avoids ERROR 2026 when server has have_ssl=DISABLED)
 mkdir -p /etc/my.cnf.d
-printf '[client]\nskip-ssl = true\n' > /etc/my.cnf.d/cyberpanel-client.cnf
+printf '[client]\nssl=0\nskip-ssl\n' > /etc/my.cnf.d/cyberpanel-client.cnf
+# If client still requires SSL, add [client] to main my.cnf (only if not already present)
+grep -q '^\[client\]' /etc/my.cnf 2>/dev/null || echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf

 # Now this should work and show the *actual* server version on 3306
 mariadb -e "SELECT @@version;"
--- a/upgrade_modules/05_repository.sh
+++ b/upgrade_modules/05_repository.sh
@@ -261,6 +261,7 @@ EOF
    dnf clean metadata --disablerepo='*' --enablerepo=mariadb 2>/dev/null || true
    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade
    MARIADB_OLD_10=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10" ]] && MARIADB_OLD_10=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    # Also detect 11.x by package version (e.g. MariaDB-server-11.8.6-1.el9)
    [[ -z "$MARIADB_OLD_11" ]] && MARIADB_OLD_11=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
@@ -274,7 +275,7 @@ EOF
      rpm -e "$MARIADB_OLD_10" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -288,7 +289,7 @@ EOF
      rpm -e "$MARIADB_OLD_11" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -311,7 +312,7 @@ EOF
          rpm -e "$STILL_11" --nodeps 2>/dev/null || true
          dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-client MariaDB-devel 2>/dev/null || true
          mkdir -p /etc/my.cnf.d
-          printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+          printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
          systemctl start mariadb 2>/dev/null || true
          sleep 2
          mariadb-upgrade -u root 2>/dev/null || true
@@ -321,7 +322,11 @@ EOF
    fi
    # Allow local client to connect without SSL (11.x client defaults to SSL; 10.x server may not have it)
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    # Ensure main my.cnf has [client] without SSL when server has SSL disabled (ERROR 2026 fix)
+    if [[ -f /etc/my.cnf ]] && ! grep -q '^\[client\]' /etc/my.cnf 2>/dev/null; then
+      echo -e "\n[client]\nssl=0\nskip-ssl" >> /etc/my.cnf
+    fi
    # Optional: migrate from latin1 to UTF-8 (utf8mb4) when --migrate-to-utf8 and 11.x/12.x
    if [[ "$Migrate_MariaDB_To_UTF8_Requested" = "yes" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
      Migrate_MariaDB_To_UTF8
@@ -346,6 +351,7 @@ EOF
    
    # Install/upgrade MariaDB from our repo (any version: 10.11, 11.8, 12.x). Manual path for 10->11 and 11->12.
    MARIADB_OLD_10_AL9=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
+    [[ -z "$MARIADB_OLD_10_AL9" ]] && MARIADB_OLD_10_AL9=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
    MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
    [[ -z "$MARIADB_OLD_11_AL9" ]] && MARIADB_OLD_11_AL9=$(rpm -qa 'MariaDB-server*' 2>/dev/null | grep -E 'MariaDB-server-11\.' | head -1)
    if [[ -n "$MARIADB_OLD_10_AL9" ]] && { [[ "$MARIADB_VER_REPO" =~ ^11\. ]] || [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; }; then
@@ -357,7 +363,7 @@ EOF
      rpm -e "$MARIADB_OLD_10_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -371,7 +377,7 @@ EOF
      rpm -e "$MARIADB_OLD_11_AL9" --nodeps 2>/dev/null || true
      dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
      mkdir -p /etc/my.cnf.d
-      printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+      printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
      systemctl start mariadb 2>/dev/null || true
      sleep 2
      mariadb-upgrade -u root 2>/dev/null || true
@@ -383,7 +389,7 @@ EOF
    fi
    # Allow local client to connect without SSL
    mkdir -p /etc/my.cnf.d
-    printf "[client]\nskip-ssl = true\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
+    printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true

    # Install additional required packages (omit curl - AlmaLinux 9 has curl-minimal, avoid conflict)
    dnf install -y wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel 2>/dev/null || dnf install -y --allowerasing wget unzip zip rsync firewalld psmisc git python3 python3-pip python3-devel