Oracle 5.0, Reference Manual

Page: 585 / 3232

Keeping Passwords Secure
565
promote a more secure default configuration. (DBAs can disable it at their discretion, but this is not
recommended.)
In addition, the
mysql
client supports a
--secure-auth
[269] option that is analogous to
secure_auth
[490] , but from the client side. It can be used to prevent connections to less secure
accounts that use pre-4.1 password hashing. This option is disabled by default before MySQL 5.6.7,
enabled thereafter.
Compatibility Issues Related to Hashing Methods
The widening of the
Password
column in MySQL 4.1 from 16 bytes to 41 bytes affects installation or
upgrade operations as follows:
• If you perform a new installation of MySQL, the
Password
column is made 41 bytes long
automatically.
• Upgrades from MySQL 4.1 or later to current versions of MySQL should not give rise to any issues in
regard to the
Password
column because both versions use the same column length and password
hashing method.
• For upgrades from a pre-4.1 release to 4.1 or later, you must upgrade the system tables after
upgrading. (See Section 4.4.9, “
mysql_upgrade
— Check Tables for MySQL Upgrade” .)
The 4.1 hashing method is understood only by MySQL 4.1 (and newer) servers and clients, which can
result in some compatibility problems. A 4.1 or newer client can connect to a pre-4.1 server, because
the client understands both the pre-4.1 and 4.1 password hashing methods. However, a pre-4.1 client
that attempts to connect to a 4.1 or newer server may run into difficulties. For example, a 4.0
mysql
client may fail with the following error message:
shell> mysql -h localhost -u root
Client does not support authentication protocol requested
by server; consider upgrading MySQL client
This phenomenon also occurs for attempts to use the older PHP
mysql
extension after upgrading to
MySQL 4.1 or newer. (See Section 20.7.12, “Common Problems with MySQL and PHP” .)
The following discussion describes the differences between the pre-4.1 and 4.1 hashing methods, and
what you should do if you upgrade your server but need to maintain backward compatibility with pre-4.1
clients. (However, permitting connections by old clients is not recommended and should be avoided
if possible.) Additional information can be found in
Section C.5.2.4, “
Client does not support
authentication protocol
” . This information is of particular importance to PHP programmers
migrating MySQL databases from versions older than 4.1 to 4.1 or higher.
The differences between short and long password hashes are relevant both for how the server uses
passwords during authentication and for how it generates password hashes for connected clients that
perform password-changing operations.
The way in which the server uses password hashes during authentication is affected by the width of the
Password
column:
• If the column is short, only short-hash authentication is used.
• If the column is long, it can hold either short or long hashes, and the server can use either format:
• Pre-4.1 clients can connect, but because they know only about the pre-4.1 hashing method, they
can authenticate only using accounts that have short hashes.
• 4.1 and later clients can authenticate using accounts that have short or long hashes.
Even for short-hash accounts, the authentication process is actually a bit more secure for 4.1 and later
clients than for older clients. In terms of security, the gradient from least to most secure is: