Question: I have been bitten several times by the 'debian-sys-maint' user that is installed by default on the mysql-server packages installed from the Ubuntu repositories.

Generally what happens is I pull a fresh copy of our production database (which is not running on Debian/Ubuntu) for troubleshooting or new development and forget to exclude the mysql.user table hence losing the debian-sys-maint user. 

If we add new mysql users for whatever reason, I have to 'merge' these into my development environment as opposed to just overlaying the table.

Without the user my system still seems functional, but plagued with errors such as:

```
sudo /etc/init.d/mysql restart
Stopping MySQL database server: mysqld...failed.
error: 'Access denied for user 'debian-sys-maint'@'localhost' (using password: YES)'

```

* What is debian-sys-maint used for?
	+ Is there a better way for the package maintainers to do what they're trying to do?
* What is the easiest way to restore it after I've lost it?
* What is the correct/minimal set of privileges for this user?
	+ Seems like poor idea to 'grant all privileges on \*.\* ...'

**Edit**

Additional question - Is the password in /etc/mysql/debian.cnf already hashed or is this the plaintext password? It matters when you go to recreate the user and I never seem to get it right on the first try.

Thanks

Answer: 
The **debian-sys-maint** user is by default a **root equivalent**. It is used by certain maintenance scripts on Debian systems, and as a side-effect, allows users with root access on the box to view the plaintext password in /etc/mysql/debian.cnf (good or bad?)

You can re-create the user by:

```
GRANT ALL PRIVILEGES on *.* TO `debian-sys-maint`@`localhost` IDENTIFIED BY 'your password' WITH GRANT OPTION;

```

Just **make sure the password matches** that in /etc/mysql/debian.cnf
If you need to add the `debian-sys-maint` user just for `logrotate.d` purposes, you should **not** grant `ALL PRIVILEGES` or the `GRANT OPTION` -- this is an unnecessary giant security hole. Instead, you can just add the user with the `RELOAD` privilege like this (assuming you are accessing your db as `root`, and you replace xxxxxx with your password)

```
# add the user with the reload right
GRANT RELOAD on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'xxxxxx'; 

# reload the rights
FLUSH PRIVILEGES;

# double check
select * from mysql.user;

```

**2019 Update**

This answer may be out of date -- please see the strongly opinionated comments below.