Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-41906

mysql_secure_installation sets the root password without password_last_changed (MDEV-19516 only fixed the unix_socket path), so a just-set password can be treated as expired

    XMLWordPrintable

Details

    Description

      `mysql_secure_installation` has two paths that set the root password metadata:

      • `scripts/mysql_secure_installation.sh:460` — the unix_socket conversion path writes both
        `$.authentication_string` *and* `$.password_last_changed` (`UNIX_TIMESTAMP()`).
      • `scripts/mysql_secure_installation.sh:329` — the "set root password" path
        (`set_root_password()`, `:306`) escapes the password (`:328`) and then
        `json_set()`s only `$.authentication_string` with `PASSWORD()`; it does *not* write
        `$.password_last_changed`.
      • `scripts/mysql_secure_installation.sh:493` — the caller loop that reaches the password path.

      MDEV-19516 fixed only the unix_socket branch, so the direct password path still leaves
      `password_last_changed` stale. When the account has a password lifetime policy
      (`default_password_lifetime`/`password_lifetime` > 0), a root password just set by the tool can be
      evaluated as older than the lifetime and treated as expired on the next login.

        1. Expected result

      Setting the root password through the installer should record `password_last_changed`
      (and clear any expired marker), exactly like the unix_socket path at line 460 does, so the new
      credential is not immediately considered expired.

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              csfuzz csfuzz
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.