problem when creating a DB service resource with the guided installation

[gramunno]

Hello,

I have a problem when trying to configure a db service from Web UI using the guided installation "(self-hosted) MySQL/MariaDB" with MariaDB.

I ran the commands of the various steps successfully until and included the step "Configure the mutual TLS" (*), where I can connect to the database server with the command 'sudo mariadb', execute 'SHOW GLOBAL VARIABLES LIKE 'have_ssl';' and obtain 'have_ssl YES'.

The next step (Setup Access) seems to be the problematic one.

I chose:
Database users: root
Database Names: mysql

Then according the procedure I should execute the following commands from the database client:
ALTER USER 'root'@'%' REQUIRE SUBJECT '/CN=root';
GRANT ALL ON %.* TO 'root'@'%';

but the first command fails, therefore I executed the following commands:

ALTER USER 'root'@'localhost' REQUIRE SUBJECT '/CN=root';
GRANT ALL ON localhost.* TO 'root'@'localhost';

The results, then, are:

1. Going to the next step of the guided procedure (Test Connection), the connection test fails - finds the database agent but cannot connect and returns the error "ERROR 1105 (HY000): connection refused"

2. The execution of the connection via tsh (after the login)
   tsh db connect mysql --db-user=root --db-name=mysql

fails with the same error "ERROR 1105 (HY000): connection refused"

3. Cannot connect anymore to the database server using the standard client:

mariadb -u root -p
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
sudo mariadb -u root -p
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
sudo mariadb
ERROR 1698 (28000): Access denied for user 'root'@'localhost'

This is the teleport log of the failure taken from the proxy machine:

Oct 09 14:44:49 tp-profile01 teleport[79971]: 2024-10-09T14:44:49+02:00 ERRO [DB:SERVIC] Failed to handle connection. error:[
Oct 09 14:44:49 tp-profile01 teleport[79971]: ERROR REPORT:
Oct 09 14:44:49 tp-profile01 teleport[79971]: Original Error: syscall.Errno connection refused
Oct 09 14:44:49 tp-profile01 teleport[79971]: Stack Trace:
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/srv/db/common/errors.go:171 github.com/gravitational/teleport/lib/srv/db/common.ConvertConnectError
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/srv/db/mysql/engine.go:295 github.com/gravitational/teleport/lib/srv/db/mysql.(*Engine).connect
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/srv/db/mysql/engine.go:107 github.com/gravitational/teleport/lib/srv/db/mysql.(*Engine).HandleConnection
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/srv/db/common/reporting.go:91 github.com/gravitational/teleport/lib/srv/db/common.(*reportingEngine).HandleConnection
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/srv/db/server.go:1088 github.com/gravitational/teleport/lib/srv/db.(*Server).handleConnection
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/srv/db/server.go:1003 github.com/gravitational/teleport/lib/srv/db.(*Server).HandleConnection
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/reversetunnel/agentpool.go:606 github.com/gravitational/teleport/lib/reversetunnel.(*AgentPool).handleLocalTransport
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/reversetunnel/agentpool.go:523 github.com/gravitational/teleport/lib/reversetunnel.(*AgentPool).handleTransport
Oct 09 14:44:49 tp-profile01 teleport[79971]: github.com/gravitational/teleport/lib/reversetunnel/agent.go:585 github.com/gravitational/teleport/lib/reversetunnel.(*agent).handleDrainChannels.func2
Oct 09 14:44:49 tp-profile01 teleport[79971]: runtime/asm_amd64.s:1695 runtime.goexit
Oct 09 14:44:49 tp-profile01 teleport[79971]: User Message: connection refused] addr:<proxy_public_IP_addr>: db/server.go:1005

It looks like there is a problem with a certificate on the client side, but I don't know how to debug and fix the issue:

Any clue?
TIA

(*) NOTE: in the page of step "Configure the mutual TLS" there is an example of mysql/mariadb configuration file showing the keys like ssl-ca (with the minus) while in the referenced MariaDB documentation (https://mariadb.com/docs/server/security/data-in-transit-encryption/enterprise-server/enable-tls/) the key is ssl_ca (with the underscore). Suggest to fix it.

[gramunno]

The problem was that the mariadb user was created with password and should have not.

About the note (*): it seems that both the minus and the underscore are valid separator in between the keywords