Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.11, 11.4, 11.8, 12.3, 13.1
-
None
-
source HEAD `c894d97781b5` (13.2.0-alpha)
Description
`mysql_secure_installation` has two paths that set the root password metadata:
- `scripts/mysql_secure_installation.sh:460` — the unix_socket conversion path writes both
`$.authentication_string` *and* `$.password_last_changed` (`UNIX_TIMESTAMP()`). - `scripts/mysql_secure_installation.sh:329` — the "set root password" path
(`set_root_password()`, `:306`) escapes the password (`:328`) and then
`json_set()`s only `$.authentication_string` with `PASSWORD()`; it does *not* write
`$.password_last_changed`. - `scripts/mysql_secure_installation.sh:493` — the caller loop that reaches the password path.
MDEV-19516 fixed only the unix_socket branch, so the direct password path still leaves
`password_last_changed` stale. When the account has a password lifetime policy
(`default_password_lifetime`/`password_lifetime` > 0), a root password just set by the tool can be
evaluated as older than the lifetime and treated as expired on the next login.
-
- Expected result
Setting the root password through the installer should record `password_last_changed`
(and clear any expired marker), exactly like the unix_socket path at line 460 does, so the new
credential is not immediately considered expired.
Attachments
Issue Links
- relates to
-
MDEV-19516 mysql_secure_installation doesn't set password_last_changed while setting password for root
-
- Closed
-