hcq/MaxScale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MXS-2891: Log password hash on mismatch

Browse Source 
By logging the password hash when user authentication fails due to a
password mismatch, we can be certain what the client sent and what is the
currently stored value in MaxScale. This should not be on by default which
is why a new parameter is required.
This commit is contained in:
Markus Mäkelä
2020-03-04 11:46:54 +02:00
parent 0aae500577
commit 1bf46fadf6
4 changed files with 53 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Documentation/Authenticators/MySQL-Authenticator.md
View File

@ -84,3 +84,12 @@ case-insensitive by converting all names into their lowercase form.
```
authenticator_options=lower_case_table_names=false
```
### `log_password_mismatch`
This parameter takes a boolean value and is disabled by default. When enabled,
password hashes are logged in the error messages when authentication fails due
to a password mismatch between the one stored in MaxScale and the one given by
the user. This feature should only be used to diagnose authentication issues in
MaxScale and should be done on a secure system as the logging of the password
hashes can be considered a security risk.