[MDEV-32513] "CHANGE MASTER TO" truncates master password to 32 characters Created: 2023-10-18  Updated: 2023-11-03

Status: Open
Project: MariaDB Server
Component/s: Authentication and Privilege System
Affects Version/s: 10.6, 10.11
Fix Version/s: 10.6, 10.11, 11.0, 11.1, 11.2

Type: Bug Priority: Major
Reporter: Thomas Dreibholz Assignee: Andrei Elkin
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 22.04.3 LTS



 Description   

Setup

On master:

CREATE USER 'replication_user'@'%' IDENTIFIED BY 'c2Z3UBzHXWQOhCsW5w21f9AmILacxyM2dyGiBuagTKSzycbHesCtwANLhdNH5NON7RvumausDlLLiQ6m';
GRANT REPLICATION SLAVE ON *.* TO 'replication_user'@'%';
FLUSH PRIVILEGES;

On slave:

STOP SLAVE;
CHANGE MASTER TO
  MASTER_USER='replication_user',  MASTER_PASSWORD='c2Z3UBzHXWQOhCsW5w21f9AmILacxyM2dyGiBuagTKSzycbHesCtwANLhdNH5NON7RvumausDlLLiQ6';
START SLAVE;

After this, the replication is working.

Problem

To produce the isse, restart the server:

sudo service mariadb restart

Now, "SHOW SLAVE STATUS \G" shows:
...
Last_IO_Error: error connecting to master 'replication_user@molde.fire.smil:3306' - retry-time: 10 maximum-retries: 100000 message: Access denied for user 'replication_user'@'fdb6:6d27:be73:4::65' (using password: YES)
...

Reason:

sudo strings /var/lib/mysql/master.info
...
replication_user
c2Z3UBzHXWQOhCsW5w21f9AmILacxyM2dyGiBuagT
...

=> The password has been truncated to 32 characters when stored in master.info. A restart of the server retrieves the truncated password, which obviously does not work.

Work-around

Using a 32-character password. This weakens security!



 Comments   
Comment by Sergei Golubchik [ 2023-11-03 ]

I think the "weakening of security" is rather theoretical, 32 characters are more than enough for any practical and even impractical purposes.

I'd say either solution would be fine:

  • CHANGE MASTER should have failed, "too long password", and limitation should be documented
  • master.info should be able to store longer passwords
Generated at Thu Feb 08 10:31:56 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.