Cleartext authentication plugin support #327
Conversation
| @@ -123,6 +123,15 @@ Default: false | |||
| `allowAllFiles=true` disables the file Whitelist for `LOAD DATA LOCAL INFILE` and allows *all* files. | |||
| [*Might be insecure!*](http://dev.mysql.com/doc/refman/5.7/en/load-data-local.html) | |||
|
|
|||
| ##### `allowClearPasswords` | |||
There was a problem hiding this comment.
Maybe allowCleartextPasswords instead? Might be a bit more descriptive
There was a problem hiding this comment.
Good suggestion. That is more descriptive. I will update the references.
| Valid Values: true, false | ||
| Default: false | ||
| ``` | ||
| `allowCleartextPasswords=true` allows the usage of the cleartext client side plugin. This can be insecure but is required by the [PAM authentication plugin](http://dev.mysql.com/doc/refman/5.5/en/pam-authentication-plugin.html). |
There was a problem hiding this comment.
Maybe this should reference the 5.6 version of the docs?
What about recommending to use SSL/TLS when using CleartextPasswords?
There was a problem hiding this comment.
|
Thank you, good suggestions. I will update the documentation url. |
|
If possible, please also rebase to the current master/HEAD. |
|
All set, should be rebased with master now. |
|
As @dveeden suggested, recommending TLS might be a good idea. |
How about this? I included a slightly modified section from the cleartext plugin documentation.
|
|
"TLS / SSL" instead of "SSL" and link it to |
| Default: false | ||
| ``` | ||
|
|
||
| `allowCleartextPasswords=true` allows using the [cleartext client side plugin](http://dev.mysql.com/doc/en/cleartext-authentication-plugin.html) if required by an account, such as one defined with the [PAM authentication plugin](http://dev.mysql.com/doc/en/pam-authentication-plugin.html). Sending passwords in clear text may be a security problem in some configurations. To avoid problems if there is any possibility that the password would be intercepted, clients should connect to MySQL Server using a method that protects the password. Possibilities include [TLS / SSL] (http://dev.mysql.com/doc/en/ssl-connections.html#tls), IPsec, or a private network. |
There was a problem hiding this comment.
I meant [TLS / SSL] (#tls), so an anchor in the README.md 😉
But I'll change that after the merge.
There was a problem hiding this comment.
That makes much more sense. Sorry about the confusion. Thank you for fixing it!
|
LGTM |
Cleartext authentication plugin support
Includes a new "allowClearPasswords" parameter. I have tested the changes with native, old and PAM authenticated accounts against Percona Server versions 5.1.73-14.12, 5.5.42-37.1 and 5.6.23-72.1