mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-30 10:31:54 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
mariadb/mysql-test/main/set_password.result

212 lines
8.6 KiB
Text
Raw Normal View History

Merge branch '10.0' into 10.1
2016-05-04 15:23:26 +02:00
set global secure_auth=0;
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
create user natauth@localhost identified via 'mysql_native_password' using '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
create user invalidauth@localhost identified via 'mysql_native_password' using 'invalid';
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
create user newpass@localhost identified by password '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
create user invalidpass@localhost identified by password 'invalid';
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
create user newpassnat@localhost identified via 'mysql_native_password';
set password for newpassnat@localhost = '*94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29';
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
create user invalidpassnat@localhost identified by password 'invalid';
set password for invalidpassnat@localhost = 'invalid';
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
create user oldauth@localhost identified with 'mysql_old_password' using '378b243e220ca493';
create user oldpass@localhost identified by password '378b243e220ca493';
create user oldpassold@localhost identified with 'mysql_old_password';
set password for oldpassold@localhost = '378b243e220ca493';
MDEV-24207: recognise mysql forms of invalid password for mysql_native_password The main goal of this patch is to prevent MariaDB's native_password_plugin from "parsing" the hex (or non hex) authentication_string. Due to how the current code is written, we convert any string (within native_password_get_salt) that has the appropriate length to a "binary" representation, that can potentially match a real password. More specifically, "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" produces the same results as "*d13c3c78dafa52d9bce09bdd1adcb7befced1ebe". The length indicator is the main indicator of an invalid password. We use use same trick with "invalid" to change its internal representation. The "parsing" mentioned is by get_salt_from_password down to char_val() and because if where it is, its effectively a static plugin API that cannot change. In supporting these, we support the SHOW CREATE USER from MySQL may have the hashed password string: *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE. Obviously this isn't a hash because it contains non-hex characters. After this patch we do however recognise the pattern; [any char, notionally *]{40 chars not all are hex} as a pattern for an invalid password. This was determined to be the general pattern that MySQL used. Reviewers: Sergei G, Vicentiu
2020-10-24 21:01:07 +11:00
create user invalidmysql57auth@localhost identified via 'mysql_native_password' using '*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE';
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
select user, host, password, plugin, authentication_string from mysql.user where user != 'root';
MDEV-17658 change the structure of mysql.user table Implement User_table_json. Fix scripts to use mysql.global_priv. Fix tests.
2018-11-24 14:13:41 +01:00
User Host Password plugin authentication_string
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
invalidauth localhost invalid mysql_native_password invalid
MDEV-24207: recognise mysql forms of invalid password for mysql_native_password The main goal of this patch is to prevent MariaDB's native_password_plugin from "parsing" the hex (or non hex) authentication_string. Due to how the current code is written, we convert any string (within native_password_get_salt) that has the appropriate length to a "binary" representation, that can potentially match a real password. More specifically, "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" produces the same results as "*d13c3c78dafa52d9bce09bdd1adcb7befced1ebe". The length indicator is the main indicator of an invalid password. We use use same trick with "invalid" to change its internal representation. The "parsing" mentioned is by get_salt_from_password down to char_val() and because if where it is, its effectively a static plugin API that cannot change. In supporting these, we support the SHOW CREATE USER from MySQL may have the hashed password string: *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE. Obviously this isn't a hash because it contains non-hex characters. After this patch we do however recognise the pattern; [any char, notionally *]{40 chars not all are hex} as a pattern for an invalid password. This was determined to be the general pattern that MySQL used. Reviewers: Sergei G, Vicentiu
2020-10-24 21:01:07 +11:00
invalidmysql57auth localhost *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE mysql_native_password *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
invalidpass localhost invalid mysql_native_password invalid
invalidpassnat localhost invalid mysql_native_password invalid
MDEV-19650: Privilege bug on MariaDB 10.4 Also fixes: MDEV-21487: Implement option for mysql_upgrade that allows root@localhost to be replaced MDEV-21486: Implement option for mysql_install_db that allows root@localhost to be replaced Add user mariadb.sys to be definer of user view (and has right on underlying table global_priv for required operation over global_priv (SELECT,UPDATE,DELETE)) Also changed definer of gis functions in case of creation, but they work with any definer so upgrade script do not try to push this change.
2020-02-19 17:50:30 +01:00
mariadb.sys localhost mysql_native_password
MDEV-17658 change the structure of mysql.user table Implement User_table_json. Fix scripts to use mysql.global_priv. Fix tests.
2018-11-24 14:13:41 +01:00
natauth localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 mysql_native_password *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
newpass localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 mysql_native_password *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
newpassnat localhost *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 mysql_native_password *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29
oldauth localhost 378b243e220ca493 mysql_old_password 378b243e220ca493
oldpass localhost 378b243e220ca493 mysql_old_password 378b243e220ca493
oldpassold localhost 378b243e220ca493 mysql_old_password 378b243e220ca493
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
connect con,localhost,natauth,test,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
connect con,localhost,oldauth,test,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
flush privileges;
connect con,localhost,natauth,test,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
connect con,localhost,oldauth,test,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
set password for natauth@localhost = PASSWORD('test2');
set password for newpass@localhost = PASSWORD('test2');
set password for newpassnat@localhost = PASSWORD('test2');
set password for oldauth@localhost = PASSWORD('test2');
set password for oldpass@localhost = PASSWORD('test2');
set password for oldpassold@localhost = PASSWORD('test2');
select user, host, password, plugin, authentication_string from mysql.user where user != 'root';
MDEV-17658 change the structure of mysql.user table Implement User_table_json. Fix scripts to use mysql.global_priv. Fix tests.
2018-11-24 14:13:41 +01:00
User Host Password plugin authentication_string
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
invalidauth localhost invalid mysql_native_password invalid
MDEV-24207: recognise mysql forms of invalid password for mysql_native_password The main goal of this patch is to prevent MariaDB's native_password_plugin from "parsing" the hex (or non hex) authentication_string. Due to how the current code is written, we convert any string (within native_password_get_salt) that has the appropriate length to a "binary" representation, that can potentially match a real password. More specifically, "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" produces the same results as "*d13c3c78dafa52d9bce09bdd1adcb7befced1ebe". The length indicator is the main indicator of an invalid password. We use use same trick with "invalid" to change its internal representation. The "parsing" mentioned is by get_salt_from_password down to char_val() and because if where it is, its effectively a static plugin API that cannot change. In supporting these, we support the SHOW CREATE USER from MySQL may have the hashed password string: *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE. Obviously this isn't a hash because it contains non-hex characters. After this patch we do however recognise the pattern; [any char, notionally *]{40 chars not all are hex} as a pattern for an invalid password. This was determined to be the general pattern that MySQL used. Reviewers: Sergei G, Vicentiu
2020-10-24 21:01:07 +11:00
invalidmysql57auth localhost *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE mysql_native_password *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
invalidpass localhost invalid mysql_native_password invalid
invalidpassnat localhost invalid mysql_native_password invalid
MDEV-19650: Privilege bug on MariaDB 10.4 Also fixes: MDEV-21487: Implement option for mysql_upgrade that allows root@localhost to be replaced MDEV-21486: Implement option for mysql_install_db that allows root@localhost to be replaced Add user mariadb.sys to be definer of user view (and has right on underlying table global_priv for required operation over global_priv (SELECT,UPDATE,DELETE)) Also changed definer of gis functions in case of creation, but they work with any definer so upgrade script do not try to push this change.
2020-02-19 17:50:30 +01:00
mariadb.sys localhost mysql_native_password
MDEV-17658 change the structure of mysql.user table Implement User_table_json. Fix scripts to use mysql.global_priv. Fix tests.
2018-11-24 14:13:41 +01:00
natauth localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpass localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
newpassnat localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldauth localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpass localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
oldpassold localhost *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E mysql_native_password *7CEB3FDE5F7A9C4CE5FBE610D7D8EDA62EBE5F4E
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
connect con,localhost,natauth,test2,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test2,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test2,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
connect con,localhost,oldauth,test2,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test2,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test2,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
flush privileges;
connect con,localhost,natauth,test2,;
select current_user();
current_user()
natauth@localhost
disconnect con;
connect con,localhost,newpass,test2,;
select current_user();
current_user()
newpass@localhost
disconnect con;
connect con,localhost,newpassnat,test2,;
select current_user();
current_user()
newpassnat@localhost
disconnect con;
MDEV-22974: mysql_native_password make "invalid" valid Per b9f3f06857ac, mysql_system_tables_data.sql creates a mysql_native_password with a salted hash of "invalid" so that `set password` will detect a native password can be applied:. SHOW CREATE USER; diligently uses this value in its output generating the SQL: MariaDB [(none)]> show create user; +---------------------------------------------------------------------------------------------------+ | CREATE USER for dan@localhost | +---------------------------------------------------------------------------------------------------+ | CREATE USER `dan`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket | +---------------------------------------------------------------------------------------------------+ Attempting to execute this before this patch results in: MariaDB [(none)]> CREATE USER `dan2`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket; ERROR 1372 (HY000): Password hash should be a 41-digit hexadecimal number As such, deep the implementation of mysql_native_password we make "invalid" valid (pun intended) such that the above create user will succeed. We do this by storing "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" (credit: Oracle MySQL), that is of an INCORRECT length for a scramble. In native_password_authenticate we check the length of this cached value and immediately fail if it is anything other than the scramble length. native_password_get_salt is only called in the context of set_user_salt, so all setting of native passwords to hashed content of 'invalid', quite literally create an invalid password. So other forms of "invalid" are valid SQL in creating invalid passwords: MariaDB [(none)]> set password = 'invalid'; Query OK, 0 rows affected (0.001 sec) MariaDB [(none)]> alter user dan@localhost IDENTIFIED BY PASSWORD 'invalid'; Query OK, 0 rows affected (0.000 sec) closes #1628 Reviewer: serg@mariadb.com
2020-07-16 16:31:59 +10:00
connect(localhost,invalidauth,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidauth,invalid,;
ERROR 28000: Access denied for user 'invalidauth'@'localhost' (using password: YES)
connect(localhost,invalidpass,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidpass,invalid,;
ERROR 28000: Access denied for user 'invalidpass'@'localhost' (using password: YES)
connect(localhost,invalidpassnat,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidpassnat,invalid,;
ERROR 28000: Access denied for user 'invalidpassnat'@'localhost' (using password: YES)
MDEV-24207: recognise mysql forms of invalid password for mysql_native_password The main goal of this patch is to prevent MariaDB's native_password_plugin from "parsing" the hex (or non hex) authentication_string. Due to how the current code is written, we convert any string (within native_password_get_salt) that has the appropriate length to a "binary" representation, that can potentially match a real password. More specifically, "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" produces the same results as "*d13c3c78dafa52d9bce09bdd1adcb7befced1ebe". The length indicator is the main indicator of an invalid password. We use use same trick with "invalid" to change its internal representation. The "parsing" mentioned is by get_salt_from_password down to char_val() and because if where it is, its effectively a static plugin API that cannot change. In supporting these, we support the SHOW CREATE USER from MySQL may have the hashed password string: *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE. Obviously this isn't a hash because it contains non-hex characters. After this patch we do however recognise the pattern; [any char, notionally *]{40 chars not all are hex} as a pattern for an invalid password. This was determined to be the general pattern that MySQL used. Reviewers: Sergei G, Vicentiu
2020-10-24 21:01:07 +11:00
connect(localhost,invalidmysql57auth,invalid,test,MASTER_PORT,MASTER_SOCKET);
connect con,localhost,invalidmysql57auth,invalid,;
ERROR 28000: Access denied for user 'invalidmysql57auth'@'localhost' (using password: YES)
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
connect con,localhost,oldauth,test2,;
select current_user();
current_user()
oldauth@localhost
disconnect con;
connect con,localhost,oldpass,test2,;
select current_user();
current_user()
oldpass@localhost
disconnect con;
connect con,localhost,oldpassold,test2,;
select current_user();
current_user()
oldpassold@localhost
disconnect con;
connection default;
drop user natauth@localhost, newpass@localhost, newpassnat@localhost;
MDEV-24207: recognise mysql forms of invalid password for mysql_native_password The main goal of this patch is to prevent MariaDB's native_password_plugin from "parsing" the hex (or non hex) authentication_string. Due to how the current code is written, we convert any string (within native_password_get_salt) that has the appropriate length to a "binary" representation, that can potentially match a real password. More specifically, "*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE" produces the same results as "*d13c3c78dafa52d9bce09bdd1adcb7befced1ebe". The length indicator is the main indicator of an invalid password. We use use same trick with "invalid" to change its internal representation. The "parsing" mentioned is by get_salt_from_password down to char_val() and because if where it is, its effectively a static plugin API that cannot change. In supporting these, we support the SHOW CREATE USER from MySQL may have the hashed password string: *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE. Obviously this isn't a hash because it contains non-hex characters. After this patch we do however recognise the pattern; [any char, notionally *]{40 chars not all are hex} as a pattern for an invalid password. This was determined to be the general pattern that MySQL used. Reviewers: Sergei G, Vicentiu
2020-10-24 21:01:07 +11:00
drop user invalidauth@localhost, invalidpass@localhost, invalidpassnat@localhost,invalidmysql57auth@localhost;
MDEV-9835 Valid password is not working after server restart On SET PASSWORD if the plugin is mysql_native_password or mysql_old_password, do reset plugin and auth_str fields.
2016-04-18 18:30:42 +02:00
drop user oldauth@localhost, oldpass@localhost, oldpassold@localhost;
Merge branch '10.0' into 10.1
2016-05-04 15:23:26 +02:00
set global secure_auth=default;
more verbose tests
2020-04-21 18:45:12 +02:00
# switching from mysql.global_priv to mysql.user
MDEV-16238 root/localhost authn prioritizes authentication_string over Password Don't let SET PASSWORD to set the password, if auth_string is set. Now SET PASSWORD always sets the plugin/auth_string fields and clears the password field (on pre-plugin mysql.user table it works as before).
2018-06-18 21:00:25 +02:00
create user foo@localhost identified with mysql_native_password;
update mysql.user set authentication_string=password('foo'), plugin='mysql_native_password' where user='foo' and host='localhost';
set password for 'foo'@'localhost' = password('bar');
flush privileges;
connect foo, localhost, foo, bar;
select user(), current_user();
user() current_user()
foo@localhost foo@localhost
show grants;
Grants for foo@localhost
MDEV-20076: SHOW GRANTS does not quote role names properly Quotes added to output.
2019-11-06 12:35:19 +01:00
GRANT USAGE ON *.* TO `foo`@`localhost` IDENTIFIED BY PASSWORD '*E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB'
MDEV-16238 root/localhost authn prioritizes authentication_string over Password Don't let SET PASSWORD to set the password, if auth_string is set. Now SET PASSWORD always sets the plugin/auth_string fields and clears the password field (on pre-plugin mysql.user table it works as before).
2018-06-18 21:00:25 +02:00
disconnect foo;
connection default;
select user,host,password,plugin,authentication_string from mysql.user where user='foo';
user host password plugin authentication_string
foo localhost mysql_native_password *E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB
empty password is a valid password, don't crash
2018-06-18 21:28:27 +02:00
set password for 'foo'@'localhost' = '';
select user,host,password,plugin,authentication_string from mysql.user where user='foo';
user host password plugin authentication_string
foo localhost mysql_native_password
MDEV-16238 root/localhost authn prioritizes authentication_string over Password Don't let SET PASSWORD to set the password, if auth_string is set. Now SET PASSWORD always sets the plugin/auth_string fields and clears the password field (on pre-plugin mysql.user table it works as before).
2018-06-18 21:00:25 +02:00
drop user foo@localhost;
more verbose tests
2020-04-21 18:45:12 +02:00
# switching back from mysql.user to mysql.global_priv
Reference in a new issue Copy permalink