0

this is my first time actually using FreeBSD so there's a chance I might have missed something big, but it's unlikely.

So I want to set up mysql on my pfSense server so I can enable historical logging on ntopng. I am aware of the dangers of doing this and I am taking the necessary precautions to keep my system secure.

I installed it by copying URLs from http://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/ and pasting them into pkg add, which worked. I got mysql56-server and all it's dependencies installed.

Because I'm on pfSense, I have to start it with service mysql-server onestart because there's no rc.conf, but when I do it I get this:

Starting mysql.
Bad -c option
/usr/local/etc/rc.d/mysql-server: WARNING: failed to start mysql

I googled for what bad -c option means for mysql and found zero answers. Not a single page describes a similar issue.

I tried deleting /var/db/mysql/* but it made no difference.

I'm stumped. Thanks in advance.

Edit: yes, there is a mysql user. The pkg automatically made it.

Improve this question

2 Answers 2

Reset to default
0

Just to get things straight, pfSense doesn't have a mysql package, so you used the official FreeBSD packages instead, by doing

pkg add http://pkg.freebsd.org/FreeBSD:11:amd64/latest/All/mysql80-server-8.0.2_1.txz

This could be the source of the problem.

pfSense 2.3 is based on pkg for the base system and pfSense packages, so the pkg repository from pfSense is used and the standard FreeBSD package repository is not available. Installing packages from FreeBSD is technically possible, but not recommended due to potential dependency problems. Passing the full URL to a package using pkg add will work, but care is needed to avoid future problems.

List of native FreeBSD packages can be found here: http://pkg.freebsd.org/freebsd:10:x86:64/latest/All/

This is from the pfSense documentation.

It could be that the MySQL package has some dependencies on programs/libs for parsing the argument list (which can't be check from here, since you didn't include all the packages you installed) or some programs/libs that are not shipped with pfSense (but are part of FreeBSD).

So you have to check if you have all dependencies installed and this means you have to track down the source of the error.

On a side note, using a Firewall appliance/OS for serving a database is in general not recommended. I'm not implying that this should never be done, but it is an unusual use case.

Improve this answer
6
  • holy crap I'm getting the packages off the freebsd 11 repo but pfsense is freebsd 10. That might be the problem. Testing tomorrow. Commented Mar 5, 2018 at 9:12
  • I feel so stupid Commented Mar 5, 2018 at 9:12
  • @LAX1DUDE mhh that could be the problem. If you use pfSense 2.3, but 2.4 is based on FreeBSD 11 as far as I know. Commented Mar 5, 2018 at 21:00
  • so I figured out that "Bad -c option." is an sh error (searchcode.com/codesearch/view/458906) which means it's being caused by one of the shell scripts from the service command. I grepped through /etc/rc.subr and found a few (possibly unescaped) sh -c calls, and when I place an echo right before the one on line 1062 I see it in the console. I've been screwing with this line for a while now, changing the quotes, changing the bad nested way of calling sh from su, with no success. Well, at least it's a lead. Commented Mar 11, 2018 at 5:53
  • @LAX1DUDE Could you add the line you found to your question? Commented Mar 11, 2018 at 6:11
0

The error is because of some kind of bad escaping method in the freebsd service shell scripts. It tries to su -c 'sh -c "..."' when you specify a specific user to run a service as, and mysql seems to cause problems with this.

I went into /usr/local/etc/rc.d/mysql-server and commented out line 54 mysql_user="mysql" and changed line 55 to mysql_limits_args="-e" and now mysql starts properly because the aforementioned code is not executed.

Do not do this on systems allowing any public connection to the database! If someone finds a remote code execution exploit then you're really screwed because mysql is running as root now, so attackers could read/write to any file on your server! Using it on localhost for ntopng should be safe because no malicious outside connections could get to it, but still, it's not a good idea.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.