Infrastructure MySQL5.6 How to store passwords

Environment:

Centos6.8x86_64

MySQL 5.6 Community Edition

650) this.width=650; "src=" Https://s5.51cto.com/wyfs02/M00/90/DE/wKioL1jzAKXwopJiAAAewk9cLng337.png "title=" 1.png "alt=" Wkiol1jzakxwopjiaaaewk9clng337.png "/>

Selectuser,host,password from mysql.user where user = ' RPL ';

+------+------+-------------------------------------------+

| user | Host |password |

+------+------+-------------------------------------------+

| RPL | %   | *624459C87E534A126498ADE1B12E0C66EDA035A3|

+------+------+-------------------------------------------+

Check the documentation for the password encryption algorithm found in MySQL as follows:

MySQL actually used two times SHA1 inclusions once unhex to encrypt the user's password.

The specific algorithm can be expressed in a formula: password_str= concat (' * ', SHA1 (Unhex (SHA1 (password))))

Experimental validation:

Select password (' RPL '), concat (' * ', SHA1 (Unhex (' SHA1 ')));

650) this.width=650; "src=" Https://s2.51cto.com/wyfs02/M02/90/DE/wKioL1jzAL_hQkIsAAAj3RlCFQ4640.png "title=" 2.png "alt=" Wkiol1jzal_hqkisaaaj3rlcfq4640.png "/>

You can see that the passwords computed are consistent.

MySQL5.6 Security of passwords

Experiment found on 5.6.34 above, execute create user [email protected] '% ' identified by ' [email protected] '; This statement does not display the plaintext password in the Binlog.

650) this.width=650; "src=" Https://s1.51cto.com/wyfs02/M01/90/DE/wKioL1jzANeTbzruAAAsEMKTvBo704.png "title=" 3.png "alt=" Wkiol1jzanetbzruaaasemktvbo704.png "/>

In the official note, the following authorization policy does not record the plaintext password.

CREATE USER ... Identified by ...

GRANT ... Identified by ...

SET PASSWORD ...

SLAVE START ... PASSWORD = ... (As of 5.6.4)

CREATE SERVER ... OPTIONS (..... PASSWORD ...) (As of 5.6.9)

ALTER SERVER ... OPTIONS (..... PASSWORD ...) (As of 5.6.9)

However, if you pay attention, you will find that when you configure the master-slave environment, the execution from the node resembles the following:

Change MASTER to

Master_host= ' 192.168.2.11 ',

Master_user= ' RPL ',

Master_password= ' RPL ',

master_port=3306,

Master_log_file= ' mysql-bin.000012 ',

MASTER_LOG_POS=500,

There will be warning hints.

This is because the change master to this operation is also a record of the plaintext password.

Infrastructure MySQL5.6 How to store passwords