Question: How do you force Drush to use all of the PDO options specified in a site's settings.php file?

Background: I am using Drupal 7.22 with Apache and the Drupal files (and Drush 5.8.0) on one physical server, and MySQL on another physical server. I have specified extended PDO options within the settings.php file in order to connect to the MySQL DB using SSL. The website itself works great, and Drupal can connect and use the DB without error. However, Drush does not establish a connection to the DB, and I receive (using -dv on Drush) the following error:

SQLSTATE[28000] [1045] Access denied for user
'drupal'@'' (using password: YES)

With the user and host being the proper user and host for the MySQL user. If I disable the SSL requirement of the DB user within MySQL, Drush connects fine. This is not an option however, as security is of importance.

I have also checked the CLI vs. the CGI .ini files, and also ensured the PDO extension was available to both.

The database lines from settings.php:

$databases = array (
  'default' => 
  array (
    'default' => 
    array (
      'database' => 'drupal',
      'username' => 'drupal',
      'password' => 'password',
      'host' => '',
      'port' => '3306',
      'driver' => 'mysql',
      'prefix' => '',
      'pdo' => array(
        PDO::MYSQL_ATTR_SSL_KEY => '/home/drupal/client-key.pem',
        PDO::MYSQL_ATTR_SSL_CERT => '/home/drupal/client-cert.pem',
        PDO::MYSQL_ATTR_SSL_CA => '/home/drupal/ca-cert.pem',

The user, password, db, ip, and file paths have been changed from the actual, but are similar in nature.

  • 1
    you probably found a nice edge case that Drush probably never expected anyone to ever use. And your LAMP stack is probably in a cloud like Rackspace or Amazon and your trying to protect your info over the wire in a shared network environment. I look forward to see what @greg_1_anderson says :).
    – tenken
    Commented May 9, 2013 at 17:39
  • That is correct in that these (web and db servers) are in a public, shared network environment, and we are most definitely in need of keeping the data secure in transit. I'm hoping that there is something simple I'm overlooking, or that can be added to Drush, as, the Drupal site itself works great!
    – Dr. Bytes
    Commented May 9, 2013 at 17:55
  • I know of -ssh-options from either here or a blog I read and this issue queue item drupal.org/node/820514. But, it seems odd that Drupal would respect the addtional parameters you supply by default and not drush. You might want to play with -ssh-options and the drush command line/config file.
    – tenken
    Commented May 9, 2013 at 18:00
  • Possibly related to drupal.org/node/1004876 Commented May 9, 2013 at 19:48
  • Watch issue github.com/drush-ops/drush/issues/965 to know about updates regarding supporting this feature in drush.
    – Junaid
    Commented Dec 30, 2014 at 12:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.