Question: I have been bitten several times by the 'debian-sys-maint' user that is installed by default on the mysql-server packages installed from the Ubuntu repositories.

Generally what happens is I pull a fresh copy of our production database (which is not running on Debian/Ubuntu) for troubleshooting or new development and forget to exclude the mysql.user table hence losing the debian-sys-maint user. 

If we add new mysql users for whatever reason, I have to 'merge' these into my development environment as opposed to just overlaying the table.

Without the user my system still seems functional, but plagued with errors such as:

```
sudo /etc/init.d/mysql restart
Stopping MySQL database server: mysqld...failed.
error: 'Access denied for user 'debian-sys-maint'@'localhost' (using password: YES)'

```

* What is debian-sys-maint used for?
	+ Is there a better way for the package maintainers to do what they're trying to do?
* What is the easiest way to restore it after I've lost it?
* What is the correct/minimal set of privileges for this user?
	+ Seems like poor idea to 'grant all privileges on \*.\* ...'

**Edit**

Additional question - Is the password in /etc/mysql/debian.cnf already hashed or is this the plaintext password? It matters when you go to recreate the user and I never seem to get it right on the first try.

Thanks

Answer: 
I wanted to just comment, but I think **correct syntax** deserves it's own entry. This will create the *debian-sys-maint* user:

```
mysql> GRANT ALL PRIVILEGES on *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'plaintextpassword' WITH GRANT OPTION; FLUSH PRIVILEGES;

```

If you still have the /etc/mysql/debian.cnf file, just use the password in there.

Feel free to come up with a more paranoid secure solution.
When using MySQL 5.6+, I would recommend using the `mysql_config_editor` command to create an entry for the user `'debian-sys-maint'@'localhost'` using the relevant password, meaning the password does not need to be stored in plain text on the server.

`mysql_config_editor set --login-path=debian-sys-maint --host=localhost --user=debian-sys-maint --password`

Following this, the debian specific config file `/etc/mysql/debian.cnf` can be altered so the username and password details are not stored in the file.

Finally, alter the logrotate file for MySQL so that it uses the login details stored in the `~/.mylogin.cnf` file instead of the debian specific file by replacing 

`/usr/bin/mysqladmin --defaults-file=/etc/mysql/debian.cnf`

with

`/usr/bin/mysqladmin --login-path=debian-sys-maint`

Hope this helps :)

Dave