mirror of
https://github.com/MariaDB/server.git
synced 2025-07-20 10:24:14 +03:00
b9f3f06857
Change the default authentication for root@localhost to IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket which provides secure passwordless login, while still allowing SET PASSWORD to work as expected. Also create a second all-privilege account for the user that owns datadir (and thus has full access to the data anyway). Compile unix_socket plugin statically into the server.
43 lines
1.2 KiB
Plaintext
43 lines
1.2 KiB
Plaintext
--source include/have_unix_socket.inc
|
|
|
|
#
|
|
# MDEV-3909 remote user enumeration
|
|
# unix_socket tests
|
|
#
|
|
update mysql.global_priv set priv=json_insert(priv, '$.plugin', 'unix_socket');
|
|
flush privileges;
|
|
|
|
# Make sure that the replace works, even if $USER is 'user' or something else
|
|
# that matches other parts of the error message.
|
|
let $replace=Access denied for user '$USER';
|
|
|
|
--echo connect(localhost,USER,,test,MASTER_PORT,MASTER_SOCKET);
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--disable_query_log
|
|
--error ER_PLUGIN_IS_NOT_LOADED
|
|
connect (fail,localhost,$USER);
|
|
--enable_query_log
|
|
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--error ER_PLUGIN_IS_NOT_LOADED
|
|
change_user $USER;
|
|
|
|
eval install plugin unix_socket soname '$AUTH_SOCKET_SO';
|
|
flush privileges;
|
|
|
|
--echo connect(localhost,USER,,test,MASTER_PORT,MASTER_SOCKET);
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--disable_query_log
|
|
--error ER_ACCESS_DENIED_NO_PASSWORD_ERROR
|
|
connect (fail,localhost,$USER);
|
|
--enable_query_log
|
|
|
|
--replace_result $replace "Access denied for user 'USER'"
|
|
--error ER_ACCESS_DENIED_NO_PASSWORD_ERROR
|
|
change_user $USER;
|
|
|
|
update mysql.global_priv set priv=json_compact(json_remove(priv, '$.plugin'));
|
|
flush privileges;
|
|
uninstall plugin unix_socket;
|
|
|