Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Followup to Security: Where are MySQL passwords stored?

The MySQL documentation provided as reference to the accepted answer does not provide any information if additional information (SALTS) is used in the hashing function (The documentation says it is not reversible, using a hash function).

Would a stolen SELECT Password FROM user be susceptible to lookup/rainbow tables?

EDIT: Are there any publicly available accounts of a mysql user table being "cracked" for passwords?

share|improve this question
    
BTW, if you are really worried about mysql authentication, then use certificate based authentication. –  Zoredache Nov 1 '11 at 18:12
    
@Zoredache not really, I am curious about the PASSWORD() function. –  Captain Giraffe Nov 1 '11 at 18:16

1 Answer 1

up vote 2 down vote accepted

The mysql passwords are not salted.

I have ran this simple test many times, and on many different mysql servers. If there was any salting at all, I would expect to see a different hash each time. But the output is always the same.

mysql> select password('password');
+-------------------------------------------+
| password('password')                      |
+-------------------------------------------+
| *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 |
+-------------------------------------------+
1 row in set (0.02 sec)

Since it is relatively weak. So as a security precaution, it is very important to not allow anyone access to grab a copy of the users database. Do not grant read access to it for users that you do not trust.

Also keep in mind, if a person already had local root privileges on the mysql server, then the mysql privileges don't really matter. The users can restart the server with the privilege system disabled.

share|improve this answer
    
Since account passwords (not from user.Password, but rather webaccount.logins.password_in_plaintext_and_as_hash ) have been exploited, I was curious if the same has been done on the user.Password attribute, or if that had extra precations. Of course if root, or console is available, all bets are off. –  Captain Giraffe Nov 1 '11 at 18:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.