3

I want to turn off secure auth, 50% Of our clients are having problems

Error: Connection using old (pre-4.1.1) authentication protocol refused (client option 'secure_auth' enabled) (2049)

I tried to add to my.cnf

[mysqld]
skip-secure-auth

But with no luck, any help? Is there any solution except changing clients database passwords, that would be a lot of job. We are using MySQL 5.6.15

4 Answers 4

3

The first problem is that (eventually) you need to identify everyone who has an old-style password and have them changed to a new-style password. Old passwords are not secure.

Now, for the immediate error, this is happening because the client has secure_auth set, but the user has an old password. In order to login with the old password, the client must disable secure_auth on the client side. How exactly you do this varies by which client you're using.

Some other workarounds can be found in the MySQL documentation: Client does not support authentication protocol

4
  • Problem is fixed when we change database user password and in config file too, but that is too much job, we have 1000 sites to change. Is there any way to skip secure auth and get sites working withouth changing a password Feb 6, 2014 at 23:38
  • 1
    Everyone will have to do it sooner or later. You can avoid it only for so long (and you already avoided it for too many years). Feb 6, 2014 at 23:39
  • Can you please tell me how to avoid it, i searched all over the internet over 5 hours... Feb 6, 2014 at 23:42
  • Regarding how to identify anyone with old-style password: Once set session old_passwords = 'OFF'; you can identify them by their shorter hashes in the user table. A reminder email can then be sent to them periodically asking them to set password = password('neworsamepasswordasbefore'); That's right they do not need to actually change to a different password though for security reasons you would prefer them to. Jun 12, 2014 at 0:28
8

On the command line, use something like the following, if you have no choice...

mysql -uTheUseerNAme -pThePassword DbName -h HostName --skip-secure-auth

Hope this helps someone, as this was my problem connecting from a Linux

1
4

If it is the client requiring to disable the secure auth, you should disable it on the client, not on the server. In your example, put it in the [mysql] section, not [mysqld]

[mysql] skip-secure-auth

1
2

I believe this should be added to your my.cnf:

secure-auth = OFF

4
  • 3
    Welcome to ServerFault, and thanks for helping! It would be even better if you'd add a short description of why this configuration change would help, so the poster can have some idea of why your suggestion is the one to follow.
    – Jenny D
    Apr 17, 2014 at 7:44
  • 1
    @JennyD: Well.. it seems like a really precise answer to me, which does not need an explanation at all?
    – MichelZ
    Apr 17, 2014 at 8:26
  • 3
    It is a precise answer on what to do. It does not answer why. It would be a good idea to read serverfault.com/help/how-to-answer instead of skipping it...
    – Jenny D
    Apr 17, 2014 at 8:29
  • I don't think OFF is a valid value for secure auth (which should really by secure_auth with an underscore). FALSE is supposedly acceptable, but was mis-parsed in some versions (bugs.mysql.com/bug.php?id=75425) Apr 3, 2015 at 13:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .