Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It only takes a minute to sign up.
Sign up to join this community
Is there a query that a MySQL user that does not have admin rights can run to determine if they are using the old (pre-4.1) hash or the new (4.1-and-later) hash? This user was explicitly granted access only to their own database and not to any of the system tables (such as mysql.user).
This is on a MySQL 5.5 system.
No, a user would need SELECT on mysql.user to be able to read the password column, or the SUPER privilege to be able to see the password in the output of SHOW GRANTS. I think both of those would be classed as "admin rights".
mysql> SHOW VARIABLES LIKE 'old_passwords';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| old_passwords | 0 |
+---------------+-------+
ysql> SHOW GRANTS;
------------------------------------------------------------------------------------------------------------+
Grants for try@localhost |
------------------------------------------------------------------------------------------------------------+
GRANT USAGE ON *.* TO 'try'@'localhost' IDENTIFIED BY PASSWORD '*01E3DDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' |
GRANT ALL PRIVILEGES ON `try`.* TO 'try'@'localhost' |
------------------------------------------------------------------------------------------------------------+
The first query says whether old passwords are allow (0=no).
The second shows my encrypted password; it is a "new" password. If had been something like BY PASSWORD '012346789ABCDEF', it would be "old".
Old: 16 hex; New: '*' plus lots of hex.
Try it on yourself.
