Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-30178

Error message when 'require_secure_transport' is enabled should be more explict

Details

    Description

      'require_secure_transport' is introduced since 10.4 Enterprise

      https://mariadb.com/docs/skysql/ref/mdb/system-variables/require_secure_transport/

      When this option is enabled, connections attempted using insecure transport will be rejected. Secure transports are SSL/TLS, Unix sockets or named pipes.

      However the error message emitted when connection s refused is not at all explanatory. If this variable is enabled and a client tries to connect without encryption, following error message will be seen:

      ERROR 1045 (28000): Access denied for user '<user>'@'localhost' (using password: [YES|NO])
      

      It does not provide any useful information to suggest user to connect with encryption, neither does it mention the related parameter 'require_secure_transport'.

      The equivalent message from MySQL for example contains more information:

      MySQL Error 3159 (HY000): Connections using insecure transport are prohibited while --require_secure_transport=ON.
      

      It would be beneficial to change this error message in MariaDB to reflect that the variable is enabled and to suggest user to use encrypted connection.

      Attachments

        Issue Links

          Activity

            dlenski Daniel Lenski (Inactive) added a comment - - edited

            serg wrote:

            The latter should've enabled cert validation by default (preventing MitM) but I didn't push it, as it would've broken almost every ssl-enabled MariaDB installation in the world.

            The counterargument is that "almost every ssl-enabled MariaDB installation in the world" is already broken: an ISP or government can easily MITM traffic to/from MariaDB servers if they're not actually doing certification validation.

            This has been an extremely common and plausible threat model for almost a decade now.

            dlenski Daniel Lenski (Inactive) added a comment - - edited serg wrote: The latter should've enabled cert validation by default (preventing MitM) but I didn't push it, as it would've broken almost every ssl-enabled MariaDB installation in the world. The counterargument is that "almost every ssl-enabled MariaDB installation in the world" is already broken: an ISP or government can easily MITM traffic to/from MariaDB servers if they're not actually doing certification validation. This has been an extremely common and plausible threat model for almost a decade now.

            Yes, you're right. They're already broken.
            Still from the user PoV they work, and I'm not sure we should pull the plug from all those installations at once.

            serg Sergei Golubchik added a comment - Yes, you're right. They're already broken. Still from the user PoV they work, and I'm not sure we should pull the plug from all those installations at once.
            danblack Daniel Black added a comment -

            serg I assume you want to review everything to do with authentication.

            AFAIK https://github.com/MariaDB/server/pull/2581 looks correct.

            Which version to target is an outstanding question. In its current from using the same 28000 is back to 10.5 ok?

            danblack Daniel Black added a comment - serg I assume you want to review everything to do with authentication. AFAIK https://github.com/MariaDB/server/pull/2581 looks correct. Which version to target is an outstanding question. In its current from using the same 28000 is back to 10.5 ok?

            AFAIK https://github.com/MariaDB/server/pull/2581 looks correct.

            + dufravin, who's the author of this PR.

            dlenski Daniel Lenski (Inactive) added a comment - AFAIK https://github.com/MariaDB/server/pull/2581 looks correct. + dufravin , who's the author of this PR.
            serg Sergei Golubchik added a comment - https://github.com/MariaDB/server/pull/2581/commits/f6535644da is ok to push

            People

              danblack Daniel Black
              Tingynia Tingyao Nian
              Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.