mysql - Mariadb 在日志文件中显示密码

Question

查看 mariadb 日志，我看到所有以明文形式登录的密码，例如 IDENTIFIED BY 。有什么选择或方法可以抑制这种情况。这是一个巨大的安全风险。

感谢任何帮助。

MariaDB [(none)]> SHOW VARIABLES LIKE "%version%";
+-------------------------+-----------------------------------+
| Variable_name           | Value                             |
+-------------------------+-----------------------------------+
| innodb_version          | 5.5.41-MariaDB-37.0               |
| protocol_version        | 10                                |
| slave_type_conversions  |                                   |
| version                 | 5.5.42-MariaDB-wsrep              |
| version_comment         | MariaDB Server, wsrep_25.11.r4026 |
| version_compile_machine | x86_64                            |
| version_compile_os      | Linux                             |
+-------------------------+-----------------------------------+

Answer 1

如果您使用audit plug-in v1.2 or newer ，然后 mariadb 会屏蔽某些查询中的密码。具体来说:

Since version 1.2.0, passwords have been replaced by asterisks in the logs for certain queries, including:

GRANT, CREATE USER, CREATE MASTER, CREATE SERVER, ALTER SERVER

Passwords given with the PASSWORD() and OLD_PASSWORD() functions in DML statements will still be logged as plain text in queries, as will key strings used with encrypt functions such as ENCODE() and AES_ENCRYPT().

此外，您可以通过传统方式通过限制访问权限、使用文件系统级加密来保护日志文件。实际上，只有 DBA 应该有权访问服务器日志，而且他们几乎可以在数据库中执行任何操作。