Don't Set MySQL Root Password

[Ttech]

When doing the configuration for production, the setup script sets the MYSQL Password and the 'ctf' user password.

The 'ctf' user by default has the password 'ctf', as well, which might be insecure.

Ideally, these credentials should be generated randomly and given to the setup to be used.

[gsingh93]

I don't think this is a huge issue because the MySQL only listens on localhost by default. I do think it's a good idea for users to change it on their own, but it will definitely create more confusion for people if we do it automatically in the provision script (scroll through the closed issues and see how many are about what the password is).

[Ttech]

I agree - but thats why I was suggesting a output message of "here are the passwords" don't forget!
This turned out to be quite a problem when setting this up for external listening on the mysql server.
Since I had to stop everything and start it up to get the password of root set properly and then while I was doing that changed the ctf password.

[gsingh93]

So we actually randomly generate a password for the admin user when you provision in prod mode, and that gets printed out at the end of provisioning. A lot of the issues we had after launch were because people didn't read the output at the end and missed the password.

Maybe we can have a flag for the provision script (off by default) that randomly generates the password?

[javuto]

We could define the mysql password as a parameter in the provision script or have it generated. For now is just hardcoded and this does not really go well with previous installations of MySQL.

[rdenman]

For those that do want to change the default MySQL password (which should be anyone actually running a competition), you'll need to change the /var/www/fbctf/settings.ini DB_PASSWORD parameter. If you do not edit settings.ini, then when you change the password in MySQL you're platform will no longer load/work.