Oracle 5.0 Reference Manual Download

Page: 587 / 3232

Keeping Passwords Secure

567

+-------------------------+------------------------+

1 row in set (0.00 sec)

mysql>

CREATE USER 'newuser'@'localhost' IDENTIFIED BY 'newpass';

Query OK, 0 rows affected (0.03 sec)

mysql>

SET PASSWORD FOR 'existinguser'@'localhost' = PASSWORD('existingpass');

Query OK, 0 rows affected (0.00 sec)

The following scenarios are possible in MySQL 4.1 or later. The factors are whether the

Password

column is short or long, and, if long, whether the server is started with

old_passwords

[480]

enabled

or disabled.

Scenario 1: Short

Password

column in user table:

• Only short hashes can be stored in the

Password

column.

• The server uses only short hashes during client authentication.

• For connected clients, password hash-generating operations involving the

PASSWORD()

[956]

function or password-generating statements use short hashes exclusively. Any change to an
account's password results in that account having a short password hash.

• The value of

old_passwords

[480]

is irrelevant because with a short

Password

column, the server

generates only short password hashes anyway.

This scenario occurs when a pre-4.1 MySQL installation has been upgraded to 4.1 or later but

mysql_upgrade

has not been run to upgrade the system tables in the

mysql

database. (This is not a

recommended configuration because it does not permit use of more secure 4.1 password hashing.)

Scenario 2: Long

Password

column; server started with

old_passwords=1

[480]

• Short or long hashes can be stored in the

Password

column.

• 4.1 and later clients can authenticate for accounts that have short or long hashes.

• Pre-4.1 clients can authenticate only for accounts that have short hashes.

• For connected clients, password hash-generating operations involving the

PASSWORD()

[956]

function or password-generating statements use short hashes exclusively. Any change to an
account's password results in that account having a short password hash.

In this scenario, newly created accounts have short password hashes because

old_passwords=1

[480]

prevents generation of long hashes. Also, if you create an account with

a long hash before setting

old_passwords

[480]

to 1, changing the account's password while

old_passwords=1

[480]

results in the account being given a short password, causing it to lose the

security benefits of a longer hash.

To create a new account that has a long password hash, or to change the password of any existing
account to use a long hash, first set the session value of

old_passwords

[480]

set to 0 while leaving

the global value set to 1, as described previously.

In this scenario, the server has an up to date

Password

column, but is running with the default

password hashing method set to generate pre-4.1 hash values. This is not a recommended
configuration but may be useful during a transitional period in which pre-4.1 clients and passwords
are upgraded to 4.1 or later. When that has been done, it is preferable to run the server with

Oracle 5.0, Reference Manual

Search results

Summary of Contents for 5.0

Reviews:

Related manuals for 5.0

Brands by name

Popular brands