[MDEV-12605] Bug in userstats plugin Denied_connection/Acess_deined counters Created: 2017-04-27  Updated: 2017-05-02

Status: Confirmed
Project: MariaDB Server
Component/s: Admin statements
Affects Version/s: 5.5, 10.0, 10.1, 10.0.29, 10.2
Fix Version/s: 10.2

Type: Bug Priority: Minor
Reporter: Rhys Campbell Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: userstats


 Description   

Email thread from the MariaDB mailing list...

Hi, Rhys.Campbell!

On Apr 26, Rhys.Campbell@XXXXXXXXXXXX wrote:
> Hello All,
>
> I've been using the userstats plugin to debug an application issue and
> I think there's a bug in the collection of statistics, or at least a
> case of bad wording...
>
> https://mariadb.com/kb/en/mariadb/user-statistics/
>
> DENIED_CONNECTIONS - The number of connections denied to this user.
> ACCESS_DENIED - The number of times this user's connections issued commands that were denied.
>
> A application user was displaying very high "DENIED_CONNECTION"
> values. This sent us in the direction a bad password was being
> supplied. Long story short it actually turns out that a series of
> ALTER TABLE statements were failing, because the application does not
> have permission to do so.
>
> During one our tests DENIED_CONNECTION was 5397 and ACCESS_DENIED was
> 0. We can see the ALTER TABLE statement failing and DENIED_CONNECTION
> being incremented quickly. According to the documentation shouldn't
> this ACCESS_DENIED (which I think might be better named
> COMMAND_DENIED?) be incremented?

It's a bug. Could you please report it at jira.mariadb.org?

Regards,
Sergei
Chief Architect MariaDB
and security@mariadb.org



 Comments   
Comment by Elena Stepanova [ 2017-05-02 ]

CREATE USER foo@'127.0.0.1';
SET GLOBAL userstat=1;
 
--connect (con1,127.0.0.1,foo,,,$MASTER_MYPORT)
 
--connection default
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
 
--connection con1
--error ER_DBACCESS_DENIED_ERROR
CREATE DATABASE db;
 
--connection default
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
 
CREATE DATABASE db;
GRANT SELECT ON db.* TO foo@'127.0.0.1';
CREATE TABLE db.t1 (i INT);
 
--connection con1
--error ER_TABLEACCESS_DENIED_ERROR
ALTER TABLE db.t1 ENGINE=MyISAM;
 
--connection default
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
 
--connection con1
--error ER_TABLEACCESS_DENIED_ERROR
ALTER TABLE db.t1 ENGINE=MyISAM;
 
--connection default
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
 
--connection con1
--error ER_TABLEACCESS_DENIED_ERROR
ALTER TABLE db.t1 ENGINE=MyISAM;
 
--connection default
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
 
--disconnect con1
 
--connection default
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
 
DROP USER foo@'127.0.0.1';
SET GLOBAL userstat=DEFAULT;
DROP DATABASE db;

Result on 10.2

connect  con1,127.0.0.1,foo,,,$MASTER_MYPORT;
connection default;
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
USER	ACCESS_DENIED	DENIED_CONNECTIONS
foo	0	0
connection con1;
CREATE DATABASE db;
ERROR 42000: Access denied for user 'foo'@'127.0.0.1' to database 'db'
connection default;
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
USER	ACCESS_DENIED	DENIED_CONNECTIONS
root	0	0
foo	1	1
CREATE DATABASE db;
GRANT SELECT ON db.* TO foo@'127.0.0.1';
CREATE TABLE db.t1 (i INT);
connection con1;
ALTER TABLE db.t1 ENGINE=MyISAM;
ERROR 42000: ALTER command denied to user 'foo'@'localhost' for table 't1'
connection default;
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
USER	ACCESS_DENIED	DENIED_CONNECTIONS
root	0	0
foo	2	3
connection con1;
ALTER TABLE db.t1 ENGINE=MyISAM;
ERROR 42000: ALTER command denied to user 'foo'@'localhost' for table 't1'
connection default;
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
USER	ACCESS_DENIED	DENIED_CONNECTIONS
root	0	0
foo	3	6
connection con1;
ALTER TABLE db.t1 ENGINE=MyISAM;
ERROR 42000: ALTER command denied to user 'foo'@'localhost' for table 't1'
connection default;
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
USER	ACCESS_DENIED	DENIED_CONNECTIONS
root	0	0
foo	4	10
disconnect con1;
connection default;
SELECT USER, ACCESS_DENIED, DENIED_CONNECTIONS FROM INFORMATION_SCHEMA.USER_STATISTICS;
USER	ACCESS_DENIED	DENIED_CONNECTIONS
root	0	0
foo	4	14

So, the effect I observe is slightly different from the described, but looks equally wrong
The Access denied error does actually increase the value of ACCESS_DENIED variable; but every time it happens, it looks like DENIED_CONNECTIONS i simultaneously increased by the new value of ACCESS_DENIED. And upon disconnect it happens again, the value of ACCESS_DENIED is added to DENIED_CONNECTIONS.

The test users USER_STATISTICS, it seems to be the same for CLIENT_STATISTICS.

On Percona server 5.6/5.7 with the same test case I didn't get any activity in any of the variables, they both remained 0.

Generated at Thu Feb 08 07:59:01 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.