content_image/661291.jpg
<img src='content_image/661291.jpg'>

## Note 

The client-side mysql_clear_password  authentication plugin leaves the password untouched, so client programs send it to the MySQL server as cleartext. 

This enables the password to be passed as is to PAM. A cleartext password is necessary to use the server-side PAM library, but may be a security problem in some configurations. These measures minimize the risk: 

•To make inadvertent use of the mysql_clear_password  plugin less likely, MySQL clients must explicitly enable it (for example, with the --enable- cleartext-plugin  option). See Section 6.4.1.4, “Client-Side Cleartext Pluggable Authentication” . 

•To avoid password exposure with the mysql_clear_password  plugin enabled, MySQL clients should connect to the MySQL server using an encrypted connection. See Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . 

## PAM Authentication Access to Unix Password Store 

On some systems, Unix authentication uses a password store such as /etc/shadow , a file that typically has restricted access permissions. This can cause MySQL PAM-based authentication to fail. Unfortunately, the PAM implementation does not permit distinguishing “password could not be checked”  (due, for example, to inability to read /etc/shadow ) from “password does not match.”  If you are using Unix password store for PAM authentication, you may be able to enable access to it from MySQL using one of the following methods: 

•Assuming that the MySQL server is run from the mysql  operating system account, put that account in the shadow  group that has /etc/shadow  access: 

1. Create a shadow  group in /etc/group . 

2. Add the mysql  operating system user to the shadow  group in /etc/group . 

3. Assign /etc/group  to the shadow  group and enable the group read permission: 

chgrp shadow /etc/shadow chmod g+r /etc/shadow 

4. Restart the MySQL server. 

•If you are using the pam_unix  module and the unix_chkpwd  utility, enable password store access as follows: 

## PAM Authentication Debugging 

chmod u-s /usr/sbin/unix_chkpwd setcap cap_dac_read_search+ep /usr/sbin/unix_chkpwd 

Adjust the path to unix_chkpwd  as necessary for your platform. 

The PAM authentication plugin checks at initialization time whether the AUTHENTICATION_PAM_LOG environment value is set (the value does not matter). If so, the plugin enables logging of diagnostic messages to the standard output. These messages may be helpful for debugging PAM-related issues that occur when the plugin performs authentication. 

Some messages include reference to PAM plugin source files and line numbers, which enables plugin actions to be tied more closely to the location in the code where they occur. 

