![\"Watch](\"https:\/\/ingmarverheij.com\/wp-content\/uploads\/2013\/04\/Badass.jpg\" "\\"\\"")
<\/a>Since I\u2019m building an environment including Atlantis ILIO I thought it would be good to learn about the internals of it. Having to troubleshoot some configuration issues motivated me to see (and maybe change) the configuration. So I\u2019m not a badass hacking<\/a> the database for malicious reasons.<\/p>\n<\/p>\n
Atlantis ILIO center<\/font><\/h2>\nOnly the Atlantis ILIO center machine has a database, session- and replication hosts don\u2019t. Atlantis ILIO center is the management machine that manages the Atlantis ILIO session- and replication hosts that do the actual \u201cIn-Line-Image-Optimization\u201d work.
<\/p>\n
MySQL<\/font><\/h5>\nThe machine runs a MySQL server (version 5.1.63<\/a>) with one database (or schema), called ibert<\/strong>. The ibert database has three users 1)<\/p>\nroot <\/li>\n ibert <\/li>\n debian-sys-maint\nThe (out-of-the-box or) default <\/strong>credentials of an Atlantis ILIO center machine is root\/admin (username\/password). The password of the root account (used for remote access via the management webpage) can easily be changed. There is no direct relation between the root <\/em>user to gain access to the machine, and the root <\/em>user of the ibert<\/em> database. However the password of the root <\/em>user in the ibert <\/em>database is admin<\/strong>.<\/p>\n <\/p>\n
Access the database locally<\/font><\/h5>\nOnce you are connected to a console session (or via SSH) of the Atlantis ILIO center machine, gaining access to the ibert<\/em> database is easy.<\/p>\nroot@ilio: ~# mysql -u root -p ibert\nEnter password: admin\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nWelcome to the MySQL monitor. Commands end with ; or \\g.\nYour MySQL connection id is 644\nServer version: 5.1.63-0ubuntu0.11.04.1 (Ubuntu)\n\nCopyright (c) 2000, 2011, Oracle and\/or its affiliates. All rights reserved.\n\nOracle is a registered trademark of Oracle Corporation and\/or its\naffiliates. Other names may be trademarks of their respective\nowners.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nmysql><\/pre>\n <\/p>\n
Knowing that getting access to the database is that<\/em> ease might got you to think \u201cWow! So everyone can access my ILIO database just like that?!\u201d. Well, that\u2019s not entirely true. The mysql daemon is configured to bind<\/a> only the 127.0.0.1 (or localhost) network, external networks are unable to (see or) connect to the mysql daemon.<\/p>\nAlso, access to the ibert <\/em>database is restricted to the user root<\/em> logging in from the host localhost<\/em>.<\/p>\n <\/p>\n
mysql> show grants;\n+----------------------------------------------------------------------------------------------------------------------------------------+\n| Grants for root@localhost |\n+----------------------------------------------------------------------------------------------------------------------------------------+\n| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY PASSWORD '*4ACFE3202A5FF5CF467898FC58AAB1D615029441' WITH GRANT OPTION |\n+----------------------------------------------------------------------------------------------------------------------------------------+\n1 row in set (0.00 sec)<\/pre>\n<\/font> <\/p>\nAccess the database remotely<\/font><\/h5>\nIf we want to connect to the Atlantis ILIO database from a remote machine (probably with a GUI like MySQL Workbench<\/a>) we need to re-configure.<\/p>\n<\/font><\/h6>\nmy.cnf<\/font><\/h6>\nFirst of all we need to enable the mysql daemon to bind to an external network. In the \/etc\/mysql\/my.cnf<\/strong> file we need to change the bind-address<\/a> from<\/p>\nbind-address\t= 127.0.0.1<\/pre>\nto<\/p>\n
#bind-address\t= 127.0.0.1<\/pre>\nTip:<\/strong> nano<\/a> is an easy editor that is installed by default (easier than vi<\/a>)<\/p>\nTo propagate the changes the daemon needs to be restarted<\/p>\n
\/etc\/init.d\/mysql restart<\/pre>\n <\/p>\n
Privileges<\/font><\/h6>\nNow you can connect to the mysql server you need the privileges to access the ibert<\/em> database from a remote host.<\/p>\nAlthough it would be possible to grant this privilege to the root<\/em> account this implies a choice with two answers 1) use the default password admin<\/em> and accept the consequences (insecure) or 2) change the password of the root <\/em>user which results in breaking the system. Therefore its probably better to create a dedicated user for remote access with a more complex password.<\/p>\nThis is done with the following command where we add a user iliouser<\/em> with the password iliopassword<\/em>.<\/p>\nCREATE USER 'iliouser'@'%' IDENTIFIED BY 'iliopassword';\nGRANT ALL PRIVILEGES ON ibert. * TO 'iliouser'@'%';<\/pre>\nfollowed by another command to propagate the changes<\/p>\n
FLUSH PRIVILEGES;<\/pre>\n <\/p>\n
ibert<\/font><\/h6>\nAnd now you\u2019re able to connect to the Atlantis ILIO center database from a remote machine ![\"Glimlach\"](\"https:\/\/ingmarverheij.com\/wp-content\/uploads\/2013\/04\/wlEmoticon-smile.png\")
<\/p>\n
![\"Atlantis](\"https:\/\/ingmarverheij.com\/wp-content\/uploads\/2013\/04\/ibert-database_thumb.png\" "\\"ibert\\"")
<\/a><\/p>\n <\/p>\n
Where can I use it for?<\/font><\/h2>\n![\"\"](\"https:\/\/ingmarverheij.com\/wp-content\/uploads\/2013\/04\/11371809-treasure-chest-with-gold-coins.jpg\" "\\"\\"")
So what kind of valuable information can we find in the database?<\/p>\n
Basically everything you can see on the Atlantis ILIO Center admin page is stored in the database. This includes the configuration but also health status, alerts and resource usage. Having access to the database enables you to retrieve this information and (if reaaaaallly necessary) to change the content.
\n <\/p>\n
<\/p>\n
<\/font><\/h5>\nEntities<\/font><\/h5>\nA good thing to start with is knowing what entities are. Each Atlantis ILIO session- or replication host is stored as a record in the [entities] <\/strong>table with a unique identifier (column id<\/strong>). The entity is used throughout the entire database to correlate the information with the machines.<\/p>\nThe [entities] <\/strong>database contains the following columns<\/p>\n
<\/p>\n
The machine runs a MySQL server (version 5.1.63<\/a>) with one database (or schema), called ibert<\/strong>. The ibert database has three users 1)<\/p>\n The (out-of-the-box or) default <\/strong>credentials of an Atlantis ILIO center machine is root\/admin (username\/password). The password of the root account (used for remote access via the management webpage) can easily be changed. There is no direct relation between the root <\/em>user to gain access to the machine, and the root <\/em>user of the ibert<\/em> database. However the password of the root <\/em>user in the ibert <\/em>database is admin<\/strong>.<\/p>\n <\/p>\n Once you are connected to a console session (or via SSH) of the Atlantis ILIO center machine, gaining access to the ibert<\/em> database is easy.<\/p>\n <\/p>\n Knowing that getting access to the database is that<\/em> ease might got you to think \u201cWow! So everyone can access my ILIO database just like that?!\u201d. Well, that\u2019s not entirely true. The mysql daemon is configured to bind<\/a> only the 127.0.0.1 (or localhost) network, external networks are unable to (see or) connect to the mysql daemon.<\/p>\n Also, access to the ibert <\/em>database is restricted to the user root<\/em> logging in from the host localhost<\/em>.<\/p>\n <\/p>\n <\/font> <\/p>\n If we want to connect to the Atlantis ILIO database from a remote machine (probably with a GUI like MySQL Workbench<\/a>) we need to re-configure.<\/p>\n First of all we need to enable the mysql daemon to bind to an external network. In the \/etc\/mysql\/my.cnf<\/strong> file we need to change the bind-address<\/a> from<\/p>\n to<\/p>\n Tip:<\/strong> nano<\/a> is an easy editor that is installed by default (easier than vi<\/a>)<\/p>\n To propagate the changes the daemon needs to be restarted<\/p>\n <\/p>\n Now you can connect to the mysql server you need the privileges to access the ibert<\/em> database from a remote host.<\/p>\n Although it would be possible to grant this privilege to the root<\/em> account this implies a choice with two answers 1) use the default password admin<\/em> and accept the consequences (insecure) or 2) change the password of the root <\/em>user which results in breaking the system. Therefore its probably better to create a dedicated user for remote access with a more complex password.<\/p>\n This is done with the following command where we add a user iliouser<\/em> with the password iliopassword<\/em>.<\/p>\n followed by another command to propagate the changes<\/p>\n <\/p>\n And now you\u2019re able to connect to the Atlantis ILIO center database from a remote machine <\/p>\n Basically everything you can see on the Atlantis ILIO Center admin page is stored in the database. This includes the configuration but also health status, alerts and resource usage. Having access to the database enables you to retrieve this information and (if reaaaaallly necessary) to change the content. A good thing to start with is knowing what entities are. Each Atlantis ILIO session- or replication host is stored as a record in the [entities] <\/strong>table with a unique identifier (column id<\/strong>). The entity is used throughout the entire database to correlate the information with the machines.<\/p>\n The [entities] <\/strong>database contains the following columns<\/p>\nAccess the database locally<\/font><\/h5>\n
root@ilio: ~# mysql -u root -p ibert\nEnter password: admin\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nWelcome to the MySQL monitor. Commands end with ; or \\g.\nYour MySQL connection id is 644\nServer version: 5.1.63-0ubuntu0.11.04.1 (Ubuntu)\n\nCopyright (c) 2000, 2011, Oracle and\/or its affiliates. All rights reserved.\n\nOracle is a registered trademark of Oracle Corporation and\/or its\naffiliates. Other names may be trademarks of their respective\nowners.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nmysql><\/pre>\n
mysql> show grants;\n+----------------------------------------------------------------------------------------------------------------------------------------+\n| Grants for root@localhost |\n+----------------------------------------------------------------------------------------------------------------------------------------+\n| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY PASSWORD '*4ACFE3202A5FF5CF467898FC58AAB1D615029441' WITH GRANT OPTION |\n+----------------------------------------------------------------------------------------------------------------------------------------+\n1 row in set (0.00 sec)<\/pre>\n
Access the database remotely<\/font><\/h5>\n
<\/font><\/h6>\n
my.cnf<\/font><\/h6>\n
bind-address\t= 127.0.0.1<\/pre>\n
#bind-address\t= 127.0.0.1<\/pre>\n
\/etc\/init.d\/mysql restart<\/pre>\n
Privileges<\/font><\/h6>\n
CREATE USER 'iliouser'@'%' IDENTIFIED BY 'iliopassword';\nGRANT ALL PRIVILEGES ON ibert. * TO 'iliouser'@'%';<\/pre>\n
FLUSH PRIVILEGES;<\/pre>\n
ibert<\/font><\/h6>\n
<\/p>\n<\/a><\/p>\nWhere can I use it for?<\/font><\/h2>\n
So what kind of valuable information can we find in the database?<\/p>\n
\n <\/p>\n
<\/p>\n<\/font><\/h5>\n
Entities<\/font><\/h5>\n
![](\"https:\/\/ingmarverheij.com\/wp-content\/uploads\/2013\/04\/Comments-that-would-be-great.png\"){kind=link}