Skip to content

Commit 6b12386

Browse files
author
Vamsikrishna Bhagi
committed
Bug #19127636 MYSQL_SECURE_INSTALLATION FAILS TO RUN IF
 THE ROOT PLUGIN IS SHA256_PASSWORD Problem: When the root user uses sha256_password, mysql_secure_installation fails to connect to the server after reading the password from mysql_secret file. Solution: mysql_secure_installation initially tries to connect with a blank password and then reads mysql_secret file to fetch the password. If the login fails with blank password, all the options in mysql handle are reset and hence the ssl options too. A step is added in this patch to set the connection options in mysql handle after the login fails with blank password.
1 parent f112fed commit 6b12386

File tree

4 files changed

+220
-0
lines changed

4 files changed

+220
-0
lines changed

‎client/mysql_secure_installation.cc

+1
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,7 @@ int get_root_password()
604604
the temporary password file.
605605
*/
606606
char *temp_pass;
607+
init_connection_options(&mysql);
607608
if (find_temporary_password(&temp_pass) == TRUE)
608609
{
609610
my_free(password);

‎mysql-test/suite/interactive_utilities/r/mysql_secure_installation_ssl.result

+117
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
SET old_passwords=2;
2+
SELECT plugin into @plugin from mysql.user where user= 'root' and host='localhost';
3+
SELECT password_last_changed into @plc from mysql.user where user= 'root' and host='localhost';
4+
SELECT password into @pwd from mysql.user where user= 'root' and host='localhost';
5+
SELECT authentication_string into @auth_str from mysql.user where user= 'root' and host='localhost';
6+
update mysql.user set plugin= 'sha256_password', authentication_string= PASSWORD('123') where user='root' and host='localhost';
7+
FLUSH PRIVILEGES;
8+
call mtr.add_suppression("Dictionary file not specified");
9+
mysql_secure_installation: [Warning] Using a password on the command line interface can be insecure.
10+
11+
Securing the MySQL server deployment.
12+
13+
14+
VALIDATE PASSWORD PLUGIN can be used to test passwords
15+
and improve security. It checks the strength of password
16+
and allows the users to set only those passwords which are
17+
secure enough. Would you like to setup VALIDATE PASSWORD plugin?
18+
19+
Press y|Y for Yes, any other key for No: Using existing root password.
20+
Change the root password? (Press y|Y for Yes, any other key for No) :
21+
... skipping.
22+
By default, a MySQL installation has an anonymous user,
23+
allowing anyone to log into MySQL without having to have
24+
a user account created for them. This is intended only for
25+
testing, and to make the installation go a bit smoother.
26+
You should remove them before moving into a production
27+
environment.
28+
29+
Remove anonymous users? (Press y|Y for Yes, any other key for No) :
30+
... skipping.
31+
32+
33+
Normally, root should only be allowed to connect from
34+
'localhost'. This ensures that someone cannot guess at
35+
the root password from the network.
36+
37+
Disallow root login remotely? (Press y|Y for Yes, any other key for No) :
38+
... skipping.
39+
By default, MySQL comes with a database named 'test' that
40+
anyone can access. This is also intended only for testing,
41+
and should be removed before moving into a production
42+
environment.
43+
44+
45+
Remove test database and access to it? (Press y|Y for Yes, any other key for No) :
46+
... skipping.
47+
Reloading the privilege tables will ensure that all changes
48+
made so far will take effect immediately.
49+
50+
Reload privilege tables now? (Press y|Y for Yes, any other key for No) : Execution number 1 was successful
51+
mysql_secure_installation: [Warning] Using a password on the command line interface can be insecure.
52+
53+
Securing the MySQL server deployment.
54+
55+
56+
VALIDATE PASSWORD PLUGIN can be used to test passwords
57+
and improve security. It checks the strength of password
58+
and allows the users to set only those passwords which are
59+
secure enough. Would you like to setup VALIDATE PASSWORD plugin?
60+
61+
Press y|Y for Yes, any other key for No:
62+
There are three levels of password validation policy:
63+
64+
LOW Length >= 8
65+
MEDIUM Length >= 8, numeric, mixed case, and special characters
66+
STRONG Length >= 8, numeric, mixed case, special characters and dictionary file
67+
68+
Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: Using existing root password.
69+
70+
Estimated strength of the password: 0
71+
Change the root password? (Press y|Y for Yes, any other key for No) :
72+
New password:
73+
74+
Re-enter new password:
75+
76+
Estimated strength of the password: 100
77+
Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : By default, a MySQL installation has an anonymous user,
78+
allowing anyone to log into MySQL without having to have
79+
a user account created for them. This is intended only for
80+
testing, and to make the installation go a bit smoother.
81+
You should remove them before moving into a production
82+
environment.
83+
84+
Remove anonymous users? (Press y|Y for Yes, any other key for No) : Success.
85+
86+
87+
Normally, root should only be allowed to connect from
88+
'localhost'. This ensures that someone cannot guess at
89+
the root password from the network.
90+
91+
Disallow root login remotely? (Press y|Y for Yes, any other key for No) : Success.
92+
93+
By default, MySQL comes with a database named 'test' that
94+
anyone can access. This is also intended only for testing,
95+
and should be removed before moving into a production
96+
environment.
97+
98+
99+
Remove test database and access to it? (Press y|Y for Yes, any other key for No) : - Dropping test database...
100+
Success.
101+
102+
- Removing privileges on test database...
103+
Success.
104+
105+
Reloading the privilege tables will ensure that all changes
106+
made so far will take effect immediately.
107+
108+
Reload privilege tables now? (Press y|Y for Yes, any other key for No) : INSERT INTO mysql.user SELECT LOWER(@@hostname),'root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL;
109+
REPLACE INTO mysql.user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL);
110+
REPLACE INTO mysql.user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL);
111+
REPLACE INTO mysql.user VALUES ('::1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL);
112+
INSERT INTO mysql.db VALUES ('%','test','','Y','Y','Y','Y','Y','Y','N','Y','Y','Y','Y','Y','Y','Y','Y','N','N','Y','Y');
113+
INSERT INTO mysql.db VALUES ('%','test\_%','','Y','Y','Y','Y','Y','Y','N','Y','Y','Y','Y','Y','Y','Y','Y','N','N','Y','Y');
114+
UNINSTALL PLUGIN validate_password;
115+
UPDATE mysql.user SET password=@pwd, password_last_changed=@plc, authentication_string=@auth_str, plugin= @plugin;
116+
FLUSH PRIVILEGES;
117+
CREATE DATABASE test;

‎mysql-test/suite/interactive_utilities/t/mysql_secure_installation_ssl-master.opt

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
$VALIDATE_PASSWORD_OPT
2+
--sha256_password_private_key_path=$MYSQL_TEST_DIR/std_data/rsa_private_key.pem
3+
--sha256_password_public_key_path=$MYSQL_TEST_DIR/std_data/rsa_public_key.pem
4+
--default_authentication_plugin=sha256_password

‎mysql-test/suite/interactive_utilities/t/mysql_secure_installation_ssl.test

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
#
2+
# Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
3+
#
4+
5+
--source include/have_ssl_communication.inc
6+
--source include/have_openssl.inc
7+
8+
SET old_passwords=2;
9+
SELECT plugin into @plugin from mysql.user where user= 'root' and host='localhost';
10+
SELECT password_last_changed into @plc from mysql.user where user= 'root' and host='localhost';
11+
SELECT password into @pwd from mysql.user where user= 'root' and host='localhost';
12+
SELECT authentication_string into @auth_str from mysql.user where user= 'root' and host='localhost';
13+
update mysql.user set plugin= 'sha256_password', authentication_string= PASSWORD('123') where user='root' and host='localhost';
14+
FLUSH PRIVILEGES;
15+
call mtr.add_suppression("Dictionary file not specified");
16+
--perl
17+
18+
# Checking if perl Expect module is installed on the system.
19+
# If not, the test will be skipped.
20+
die "Please install the Expect module ." unless(eval{require Expect});
21+
22+
use strict;
23+
require Expect;
24+
25+
my @texp;
26+
my $i;
27+
28+
# Aggregating the commands which are executed post the password is input to
29+
# mysql_secure_installation into a function with the values no.
30+
sub after_commands()
31+
{
32+
$texp[$i]->expect(1,' -re ',[ 'any other key for No' => sub {
33+
$texp[$i]->send("n\n");}]);
34+
$texp[$i]->expect(1,' -re ',[ 'any other key for No' => sub {
35+
$texp[$i]->send("n\n");}]);
36+
$texp[$i]->expect(1,' -re ',[ 'anonymous users' => sub {
37+
$texp[$i]->send("n\n");}]);
38+
$texp[$i]->expect(1,' -re ',[ 'root login' => sub {
39+
$texp[$i]->send("n\n");}]);
40+
$texp[$i]->expect(1,' -re ',[ 'test database' => sub {
41+
$texp[$i]->send("n\n");}]);
42+
$texp[$i]->expect(1,' -re ',[ 'Reload' => sub { $texp[$i]->send("n\n");}]);
43+
print "Execution number $i was successful\n";
44+
}
45+
46+
# Defining a new Expect object and invoking mysql_secure_installation
47+
sub initial_commands()
48+
{
49+
$texp[$i] = new Expect();
50+
$texp[$i]->raw_pty(1);
51+
$texp[$i]->spawn("$ENV{MYSQL_SECURE_INSTALLATION} -S $ENV{MASTER_MYSOCK} --password='123' ");
52+
}
53+
54+
# Aggregating the commands which are executed post the password is input to
55+
# mysql_secure_installation into a function with the values yes.
56+
sub after_effects()
57+
{
58+
$texp[$i]->expect(1,' -re ',[ 'any other key for No' => sub {
59+
$texp[$i]->send("y\n");}]);
60+
$texp[$i]->expect(1,' -re ',[ 'MEDIUM and 2 = STRONG' => sub {
61+
$texp[$i]->send("2\n");}]);
62+
$texp[$i]->expect(1,' -re ',[ 'any other key for No' => sub {
63+
$texp[$i]->send("y\n");}]);
64+
$texp[$i]->expect(1,' -re ',[ 'password' => sub {
65+
$texp[$i]->send("Vamsi#1234#\n");}]);
66+
$texp[$i]->expect(1,' -re ',[ 'password' => sub {
67+
$texp[$i]->send("Vamsi#1234#\n");}]);
68+
$texp[$i]->expect(1,' -re ',[ 'any other key for No' => sub {
69+
$texp[$i]->send("y\n");}]);
70+
$texp[$i]->expect(1,' -re ',[ 'anonymous users' => sub {
71+
$texp[$i]->send("y\n");}]);
72+
$texp[$i]->expect(1,' -re ',[ 'root login' => sub {
73+
$texp[$i]->send("y\n");}]);
74+
$texp[$i]->expect(1,' -re ',[ 'test database' => sub {
75+
$texp[$i]->send("y\n");}]);
76+
$texp[$i]->expect(1,' -re ',[ 'Reload' => sub { $texp[$i]->send("y\n");}]);
77+
}
78+
79+
$i = 1;
80+
initial_commands();
81+
after_commands();
82+
$i++;
83+
84+
initial_commands();
85+
after_effects();
86+
$i++;
87+
88+
EOF
89+
INSERT INTO mysql.user SELECT LOWER(@@hostname),'root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL;
90+
REPLACE INTO mysql.user VALUES ('localhost','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL);
91+
REPLACE INTO mysql.user VALUES ('127.0.0.1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL);
92+
REPLACE INTO mysql.user VALUES ('::1','root','','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N',@password,NULL);
93+
INSERT INTO mysql.db VALUES ('%','test','','Y','Y','Y','Y','Y','Y','N','Y','Y','Y','Y','Y','Y','Y','Y','N','N','Y','Y');
94+
INSERT INTO mysql.db VALUES ('%','test\_%','','Y','Y','Y','Y','Y','Y','N','Y','Y','Y','Y','Y','Y','Y','Y','N','N','Y','Y');
95+
UNINSTALL PLUGIN validate_password;
96+
UPDATE mysql.user SET password=@pwd, password_last_changed=@plc, authentication_string=@auth_str, plugin= @plugin;
97+
FLUSH PRIVILEGES;
98+
CREATE DATABASE test;

0 commit comments

Comments
 (0)