Bug #65463 Server should warn when pre-4.1 user account connection rejected
| Submitted: | 30 May 2012 14:44 | Modified: | 16 Oct 2012 5:19 |
|---|---|---|---|
| Reporter: | Todd Farmer (OCA) | Email Updates: | |
| Status: | Not a Bug | Impact on me: | |
| Category: | MySQL Server: Security: Privileges | Severity: | S3 (Non-critical) |
| Version: | 5.6.5 | OS: | Any |
| Assigned to: | CPU Architecture: | Any |
[30 May 2012 14:44]
Todd Farmer
[16 Oct 2012 5:19]
Erlend Dahl
Analysis from the dev team:
We already log a warning for this event in general logs.
-trunk/sql/sql_acl.cc
9201 static bool secure_auth(MPVIO_EXT *mpvio)
9202 {
...
9214 my_error(ER_SERVER_IS_IN_SECURE_AUTH_MODE, MYF(0),
9215 mpvio->auth_info.user_name,
9216 mpvio->auth_info.host_or_ip);
9217 general_log_print(thd, COM_CONNECT,
ER(ER_SERVER_IS_IN_SECURE_AUTH_MODE),
9218 mpvio->auth_info.user_name,
9219 mpvio->auth_info.host_or_ip);
...
So, adding the same warning into error log, would mean
that same event is getting logged twice.
Now the question is : Should this qualify for an error
log or a general log?
According to the docs (http://dev.mysql.com/doc/refman/5.6/en/error-log.html)
:
"The error log contains information indicating when mysqld was started and
stopped and also any critical errors that occur while the server is running."
A failed authentication is none of the above imho : it's normal operation.
So we shall keep it inside the general log IMHO.
So, after considering the above points, I am closing this bug as 'Not a bug'.
Portions of this website are copyright © 2001, 2002 The PHP Group
Page generated in 0.038 sec. using MySQL 8.4.7-u6-cloud
Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the
respective copyright holders.
It is not reviewed in advance
by Oracle and does not necessarily represent the opinion of
Oracle or any other party.