开发者

Can MySQL handle mixed old and new style passwords

We migrated our databases to a new server, which unfortunately had a default setting of old_passwords=1.

Because we use PASSWORD() from PHP for some functionality, the newer passwords for those applications, and ofcourse the newly created mysql root and other users all have o开发者_JAVA技巧ld style passwords.

I would like to move back to new style passwords in order for the user accounts from before the migration to work again, but I also would like the newly created users to be able to log in still.

Reading http://dev.mysql.com/doc/refman/5.0/en/password-hashing.html it seems that >4.1 servers will handle both old and new style passwords, but I would like to have some confirmation that I am reading that information correctly before I remove that line from my my.cnf, restart the server and end up in a lot of trouble


From what I have read it is pretty clear:

4.1 and later clients can authenticate using accounts that have short or long hashes.

But just make sure all your clients are also 4.1 or later. Otherwise if a pre-4.1 user changes their password, they will be locked out.

Without the --old-passwords option, the following undesirable scenario is possible:

  • An old client connects to an account that has a short password hash.

  • The client changes its own password. Without --old-passwords, this results in the account having a long password hash.

  • The next time the old client attempts to connect to the account, it cannot, because the account has a long password hash that requires the new hashing mechanism during authentication. (Once an account has a long password hash in the user table, only 4.1 and later clients can authenticate for it, because pre-4.1 clients do not understand long hashes.)

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜