| Bug #117175 | Provide secondary password usage in P_S table rather than logging on each connect | ||
|---|---|---|---|
| Submitted: | 10 Jan 2025 6:20 | Modified: | 10 Jan 2025 6:34 |
| Reporter: | Simon Mudd (OCA) | Email Updates: | |
| Status: | Duplicate | Impact on me: | |
| Category: | MySQL Server: Performance Schema | Severity: | S4 (Feature request) |
| Version: | 8.4.3 / 9.1.0 | OS: | Any |
| Assigned to: | CPU Architecture: | Any | |
[10 Jan 2025 6:30]
MySQL Verification Team
Hello Simon, Thank you for the feature request! Closing this as a duplicate of Bug #117174 regards, Umesh
[10 Jan 2025 6:34]
Simon Mudd
To be clear the type of log entry that I am talking about is this: 2025-01-10T06:23:28.153836Z 1516743 [Note] [MY-013300] [Server] Plugin mysql_native_password reported: 'Second password was used for login by user: 'username1'@'127.0.0.1'.' This is on 8.4.3 while upgrading and running 8.0 with 8.4 native_password has been enabled temporarily while credential cleanup is taking place. The same would apply once migrating to caching_sha2_password. For reference I'm aware of the option to adjust my configuration and add the error number above to my existing exclusion list of: log_error_suppression_list = 10559,10914,10926,10927,13360 For password rotation it's convenient to know which of the 2 passwords is actually being used to be sure that the user has adjusted credentials correctly.
[10 Jan 2025 6:34]
Simon Mudd
sorry for the duplicate. I'll update the original.
Description: I notice on a server which runs 8.4.3 the following: 18:35 [user@host ~]$ sudo grep MY-013300 /var/log/mysqld.log | awk '{ print $17 }' | sort | uniq -c 5128 'username1'@'127.0.0.1'.' 19 'username2'@'127.0.0.1'.' 279 'username3'@'10.%'.' 2091 'username4'@'10.%'.' 29706 'username5'@'127.0.0.1'.' 18:35 [user@host ~]$ This is very noisy, even on this "not very busy server". I'm aware that with mysqld native filtering you can remove these log entries but I think that generating them for every connect is not helpful. Some people might like this on a low activity server but on a busy server this generates unnecessary noise. How to repeat: set a secondary password for a user and use it for connections to mysqld, then look in the error log. Suggested fix: I understand some people might want to see this in logging. - I would like to see this logging to be optional behaviour I would prefer to see a P_S table which contains the username / host / counter / first_seen / last_seen entries so that I can query such usage if I want to see these metrics.