0

I've compiled & installed a mysql-5.1.59 on a x86_64 linux server.

First I set root password in cli and login:

$ bin/mysqladmin -uroot password 'somepass'
$ bin/mysql -uroot -p 'somepass'
mysql>

Login succeed!

Then I created a user using SQL statements:

mysql> grant all privileges on mydb.* to 'myuser'@'localhost' identified by 'somepass';
mysql> flush privileges;

The password is exactly the same as root.

But after I queried:

mysql> select host,user,password from mysql.user;

I noticed that the password values of the two account are not the same. And I tried login mysql with myuser but failed.

By the way if I change the root password this way:

mysql> update mysql.user set password=PASSWORD('somepass') where user='root';
mysql> flush privileges;

Then I can't login mysql with root anymore:

$ bin/mysql -uroot -p
Enter password: 
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)

This never happens on my other servers. It seems like the issue has something to do with the os. How could the hashed values different between each other? Thanks!

Dongying
  • 3
  • 2

1 Answers1

0

Although the MySQL documentation is a bit sparse in this area, I would assume it's salting the passwords.

For security, a random value called "salt" is typically added to a password before it is hashed. With the salt, the resulting hash on the same password is very different.

From Wikipedia:

The benefit provided by using a salted password is making a lookup table assisted dictionary attack against the stored values impractical, provided the salt is large enough. That is, an attacker would not be able to create a precomputed lookup table (i.e. a rainbow table) of hashed values (password + salt), because it would take too much space. A simple dictionary attack is still very possible, although much slower since it cannot be precomputed.

Code Magician
  • 23,217
  • 7
  • 60
  • 77
  • It seems like each of the two ways mentioned in the question uses different salt. – Dongying Nov 10 '11 at 06:57
  • Well it finally turns out that it was my fault... My password has a backslash in it and I forgot to escape it in the SQL statement... – Dongying Nov 10 '11 at 09:32
  • If you're using salted passwords, every password would have a unique salt. Again I don't know if this is how MySQL's passwords work but I'm glad you got your issue resolved. – Code Magician Nov 10 '11 at 16:06