Bug #74313 | Add option to restrict logging of passwords in debug log of authentication_pam | ||
---|---|---|---|
Submitted: | 10 Oct 2014 9:46 | Modified: | 11 Dec 2023 22:57 |
Reporter: | Daniël van Eeden (OCA) | Email Updates: | |
Status: | Closed | Impact on me: | |
Category: | MySQL Server: Pluggable Authentication | Severity: | S4 (Feature request) |
Version: | 5.6.21 | OS: | Any |
Assigned to: | CPU Architecture: | Any | |
Tags: | authentication, PAM, plugin, Security |
[10 Oct 2014 9:46]
Daniël van Eeden
[10 Oct 2014 9:51]
Daniël van Eeden
Changed to S4
[23 Nov 2023 11:54]
Georgi Kodinov
Posted by developer: Manual testing of the new feature: $ export AUTHENTICATION_PAM_LOG=1 entering auth_pam_server entering auth_pam_next_token auth_pam_next_token:reading at [system-auth], sep=[,] auth_pam_next_token:state=PRESPACE, ptr=[system-auth], out=[] auth_pam_next_token:state=IDENT, ptr=[system-auth], out=[] auth_pam_next_token:state=AFTERSPACE, ptr=[], out=[system-auth] auth_pam_next_token:state=DELIMITER, ptr=[], out=[system-auth] auth_pam_next_token:state=DONE, ptr=[], out=[system-auth] leaving auth_pam_next_token on /home/gkodinov/dev/B20042010-5.7/internal/plugin/pam-authentication-plugin/src/parser.c:195 auth_pam_server:password received auth_pam_server:pam_start rc=0 auth_pam_server:pam_set_item(PAM_RUSER,foo) rc=0 auth_pam_server:pam_set_item(PAM_RHOST,localhost) rc=0 $ export AUTHENTICATION_PAM_LOG=PAM_LOG_WITH_SECRET_INFO entering auth_pam_server entering auth_pam_next_token auth_pam_next_token:reading at [system-auth], sep=[,] auth_pam_next_token:state=PRESPACE, ptr=[system-auth], out=[] auth_pam_next_token:state=IDENT, ptr=[system-auth], out=[] auth_pam_next_token:state=AFTERSPACE, ptr=[], out=[system-auth] auth_pam_next_token:state=DELIMITER, ptr=[], out=[system-auth] auth_pam_next_token:state=DONE, ptr=[], out=[system-auth] leaving auth_pam_next_token on /home/gkodinov/dev/B20042010-5.7/internal/plugin/pam-authentication-plugin/src/parser.c:195 auth_pam_server:password foo received auth_pam_server:pam_start rc=0 auth_pam_server:pam_set_item(PAM_RUSER,foo) rc=0 auth_pam_server:pam_set_item(PAM_RHOST,localhost) rc=0
[23 Nov 2023 16:35]
Daniël van Eeden
That looks great. Thanks.
[11 Dec 2023 22:57]
Jon Stephens
Documented behaviour change as follows in the NDB 7.5.33 and 7.6.29 changelogs, and the MySQL 8.0.36 and 8.3.0 changelogs: Beginning with this release, the behavior of the AUTHENTICATION_PAM_LOG environment variable used in debugging the PAM authentication plugin is changed as follows: ·Setting AUTHENTICATION_PAM_LOG to an arbitrary value (except as noted in the next item) no longer includes passwords in its diagnostic messages. ·To include passwords in the diagnostic messages, set AUTHENTICATION_PAM_LOG=PAM_LOG_WITH_SECRET_INFO. For more information, see "PAM Authentication Debugging". Closed.
[11 Dec 2023 23:02]
Jon Stephens
Change also noted in the indicated section of the MySQL Manual.